Companies to do code review of crypto in an ActiveRecord / Ruby on Rails webapp?

Question

We have written a Ruby on Rails application that allows a visitor to fill out a form with personal information (name, address & other confidential details), which is stored in a database until the information can be collected by a batch process running inside institution's firewall.

To prevent attackers from getting this confidential information in the event of a database compromise, we have devised a mechanism for automatically encrypting the user's input using OpenPGP before storing it in the database.

Where can I find a company that will assess this code and provide us with a report that we will be able to show to our customers? They would need to be familiar with both cryptography and with ActiveRecord.

Answer 1

Hi,

We do, www.comsecglobal.com, or www.codefend.com.

Best, Sharone

Answer 2

Matasano are a good security research firm, and they're a Ruby shop.

Answer 3

Dwayne,

We (meaning OffByZero) would be happy to help.

We have commercial experience with both cryptography and Ruby on Rails; in fact one of our products involves the use of PKI with Rails in order to tamper-proof tokens.

Please feel free to get in touch using our contact form.

Answer 4

Is there a particular reason why the database is vulnerable in this case?

If your database is protected by a firewall, you don't gain a great deal from encrypting the data.

If the encryption mechanism is on the same system as the database, a compromise to the box will probably mean the data can be accessed regardless.

If the encryption mechanism is not on the same system, then you are in a bit better situation, but with this architecture, you can easily control who has write and read access to the database quite effectively - your web application db user can be granted very limited write permissions, and the firewall can control network traffic between the app and the db. Communication between the webapp and the secure database can be uni-directional and over SSL.

Update

Security Enhanced PostgreSQL might also be worth a look:

Security Enhanced PostgreSQL (SE-PostgreSQL) is an extension of PostgreSQL relational database management system, based on Security Enhanced Linux (SELinux)'s security model and policy.

Answer 5

I second the Matasano recommendation. I have first-hand experience with their work and am a seasoned security engineer and ror developer myself. Matasano is by far the best choice for this work.