|
|
|
|
|
|
by catmanjan
9 days ago
|
|
|
Ok Im having trouble reconciling this comment > SQL query auditing is great for knowing what queries were run but it doesn't tell you what data was actually returned With what you’re saying - sounds like cipher doesnt tell you what data was actually returned either - it will only tell you if the user could have received a decrypted version of the data right? |
|
|
Query logging would tell you what queries were executed. E.g the following would tell you that 10 user records were returned with name and email but not which users.
SELECT name, email FROM users LIMIT 10;
CipherStash can tell you the ID of every row that was returned, like:
users;email,name;1 users;email,name;2 users;email,name;3 etc
If you need to know the actual values instead of just the IDs (say when doing an investigation), you can do a query to join the audit data with the users table.
Assuming audit logs are in a table called audit with a column called record_id and a timestamp:
-- full forensic analysis SELECT name,email FROM audit LEFT JOIN users ON users.id = audit.record_id WHERE timestamp BETWEEN $1 AND $2;
And because the data is encrypted, that query will ALSO be audited. Not even admins escape the auditing :p
All of this is important for "materiality" investigations. If you suspect some data has been accessed inappropriately, knowing how much and exactly which records is very useful - especially if deciding if customer/regulator notification is required.