Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 387 At runtime, to store encrypted data in the database1. Obtain the data to be encrypted.2. Retrieve the encrypted encryption key from the registry.3. Use DPAPI to decrypt the encryption key.4. Use the TripleDESCryptoServiceProvider class with the encryption key toencrypt the data.5. Store the encrypted data in the database. At runtime, to decrypt the encrypted secrets1. Retrieve the encrypted data from the database.2. Retrieve the encrypted encryption key from the registry.3. Use DPAPI to decrypt the encryption key.4. Use the TripleDESCryptoServiceProvider class to decrypt the data.With this process, if the DPAPI account used to encrypt the encryption key isdamaged, the backup of the 3DES key can be retrieved from the backup location andbe encrypted using DPAPI under a new account. The new encrypted key can bestored in the registry and the data in the database can still be decrypted.For more information about creating a managed DPAPI library, see “How To: Createa DPAPI Library” in the “How To” section of “Microsoft patterns & practices Volume I,Building Secure ASP.NET Applications: Authentication, Authorization, and SecureCommunication” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp.Secure Sensitive Data Over the NetworkSensitive data passed across the network to and from the database server mayinclude application specific data or database login credentials. To ensure the privacyand integrity of data over the network, either use a platform-level solution (such asthat provided by a secure datacenter where IPSec encrypted communication channelsare used between servers) or configure your application to establish SSL connectionsto the database. The latter approach requires a server certificate installed on thedatabase server.For more information about using SSL and IPSec, see “How To: Use IPSec to ProvideSecure Communication Between Two Servers” and “How To: Use SSL to SecureCommunication to SQL Server 2000” in the “How To” section of “Microsoftpatterns & practices Volume I, Building Secure ASP.NET Applications: Authentication,Authorization, and Secure Communication” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp.