I need to store sensitive data (like customer photos) in a SQL database in the most secure way in case of security breaches. The data won't be accessed by the clients, only by internal processes that perform some validations.
The customers don't have any input like passwords, they just register with us and we keep track of their data. Client-side encryption is not possible in the current setup that's why we need to encrypt server-side and we also have an HSM in our private network with private keys.
One idea was to use symmetric key encryption and store that key locally. The problem with that solution is that if an attacker gets access to the server and the database, he can easily get that key and decrypt the data.
Another idea was to use the HSM module the company has and encrypt the symmetric key with the HSM public key. When the server needs to handle the data, it sends the encrypted key to the HSM and handles the symmetric key in memory only. The problem with that solution is that I need to store the HSM connection credentials and if an attacker gets ahold of it and decrypts the symmetric key, the entire database is compromised.
Would it be secure enough to generate random symmetric keys for each file we encrypt, then encrypt the symmetric key with the HSM public key and store both encrypted data and encrypted sym key?
And if so, what would be the best way to store it? A pkcs7 base64 string?