Encryption of Database

[gskibum]

Hi all, I've got a bean counter wanting to add firewalls, switches etc. as Peripheral Types. And she wants the device admin credentials added to the Peripheral Types.

My question is whether this is secure.

Ugn I wish I hadn't opened my mouth about Peripheral Types!

[bpavlov · Accepted solution]

That depends where that information is being stored. but in all likelihood that would be a very bad idea. How big is your organization? Do you have an IT Security department? What does your CIO (or the IT head honcho) have to say about this? I would not want to be in a position to give up those credentials and then be blamed if later down the road those credentials got into the wrong hands.

That's not to say that the credentials shouldn't be stored somewhere for the company to be able to reference in case of a employee termination. But I would imagine that should stay within the realm of the IT department.

[mm2270 · Accepted solution]

Seems like a total misuse of "Peripherals" if you ask me. I would fight that one, since its obviously not what its intended for, and storing that kind of sensitive information in plain text in the JSS UI seems completely crazy. The FileVault keys are stored in encrypted fields in the db, and maybe a couple of other items. But most of it is accessible with a simple login account that has the privileges to view that data.

[bpavlov · Accepted solution]

That depends where that information is being stored. but in all likelihood that would be a very bad idea. How big is your organization? Do you have an IT Security department? What does your CIO (or the IT head honcho) have to say about this? I would not want to be in a position to give up those credentials and then be blamed if later down the road those credentials got into the wrong hands.

That's not to say that the credentials shouldn't be stored somewhere for the company to be able to reference in case of a employee termination. But I would imagine that should stay within the realm of the IT department.

[mm2270 · Accepted solution]

Seems like a total misuse of "Peripherals" if you ask me. I would fight that one, since its obviously not what its intended for, and storing that kind of sensitive information in plain text in the JSS UI seems completely crazy. The FileVault keys are stored in encrypted fields in the db, and maybe a couple of other items. But most of it is accessible with a simple login account that has the privileges to view that data.

[alexjdale · Accepted solution]

Not secure, nor is it an appropriate use of the JSS. They may as well put the info in a spreadsheet.

[gskibum]

Cool glad to confirm this kind of data is not stored in a secure manner.

Fight this I will. To arms!