Question

I might at some point to invite another person into my software project. I don't mind sharing the code but the data I use is very sensitive. Once he gets hands on both pieces I wont see him again (if you know what I mean)..

The server is going to be collocated. He is going to want an admin access to the box remotely. So I am planning to have sensitive data to be in-memory only - I pump it up for a work day while I am around and then delete in the end of the day.

How na

Answer 1

If someone legitimately has superuser access to a system, you can't stop them from accessing any data on the system given time. You can certainly have data encryption to encrypt the data at rest, but what's to stop them from capturing the keystrokes that are performed when you unlock it? Or, if you're copying the data to the system from somewhere, getting a copy of that data? The possibilities are endless when you consider full administrator access. Your only legitimate hope to protect this data is to create a user tailored to have the exact level of privileges he'd need, and no more. My suggestion would be to use dummy data and a staging environment that is completely separated from production. That way he could assist with the code but not ever realistically have access to your sensitive data.

Speaking from a more general security perspective, you put intrusion detection systems on a network generally in the hopes it will detect a compromise after it's happened. You could always detect a live attacker in progress, but how to filter that from all the noise that is constantly hitting you from the internet? Given your setup, you are unlikely to even be able to determine an attack happened, since you don't mention piping your logs to another system. That of course doesn't protect your data, only could help you detect its loss after the fact.