I'm currently working on a business Java application, and we store sensitive files related to our users. What is the appropriate approach to store them securely?
Is it viable to encrypt/decrypt all the files in the business logic, and then store them in the filesystem? Then what the key could be? If I derive a key from the file uploader's password, other, authorized people won't be able to decrypt the file.
Or it would be better if we would concentrate on the infrastructure's security, because it is not frequent to encrypt files for a business application?