[Answered ]-Should I be encrypting data in a CloudSQL database?

2👍

The rather educated answer is: Yes.

Underlying encryption offered by CloudSQL is like FileVault offered by OS X – your stuff truly is encrypted, but if you’re logged in, everything is world-readable to you.

The main worry is that you, or someone who is able to compromise your server, is able to read data in plain-text. Data needs to to be encrypted, and I’ve personally gone beyond the default AES 128-bit offered by most databases and switched to AES 256-bit with initialisation vector (a different one for each encrypted content). This will ensure that the data is encrypted, inaccessible and unreadable by even yourself. Yes, your code is eventually able to decrypt but storing and protecting the decryption keys is a different topic altogether.

Leave a comment