Forum Discussion
Encrypt Suspend Data?
Presumably the data is encrypted in transit via SSL.
If your LMS encrypts data going into its database, it would only be decrypted in RAM, both at the server and client ends, right? Do you need to add an additional layer of encryption? (Mind you, I have no idea whether your LMS encrypts its stored data.)
SSL/TLS only covers data in transit. The moment it lands at either end it's decrypted, so it does nothing for data sitting in the database. The database decrypts automatically for any authorised query. So it does nothing against the threat that actually matters here, anyone with legitimate access, a Moodle admin browsing the tables, a DBA, someone reading a backup, or data leaking into logs, sees plaintext. Whether the LMS even has at-rest encryption on, you're right that we don't know, but even if it does, it wouldn't stop those people. As has already been highlighted, SL is not the right tool for doing this job...