Which data to protect and how to set that up
Opselis
Customers, secrets, the copy, staging and logs. Collection classification, encryption, IAM, retention and restore. What to put on the list and how to turn on LUKS, TLS, PBS and dump masking.
Data protection is a list of collections and controls: encryption, who reads, how long to keep, how to delete, how to restore. Tools: classification (a sheet or CMDB), LUKS or KMS on disk, TLS to the database, a secret manager, Proxmox Backup Server or a second path in the cloud, dump masking, FIM, IAM with MFA. Without the list you encrypt the disk and leave a production dump on staging.
What classification is for
You list collections so you know what is a secret, what is PII, what is a copy of PII. Identity: passwords, sessions, API keys, certificates, gateway tokens. Customers: account, address, phone, ticket content. Payment: tokens, not full PAN, if you are not a PCI agent. Copies: VM, database, object storage. Logs: whether they carry email and IP. Staging and a laptop. The admin panel and agency access. GDPR needs this list at a leak notification. You make it earlier, because during an incident there is no time for inventory.
How collection protection works
Encryption at rest (LUKS on the volume, KMS on the bucket) protects a disk stolen from the rack. TLS (database, Redis, HTTPS) protects the network. IAM: a named account, MFA, a short session, no shared “store” password. Retention: log 90 days, copy 30/90/365 per prune. Deletion: the customer account and the backup that still holds the row. FIM detects a change to env.php. A restore without a test is not protection: you do not know whether the copy boots.
How to set it up
A sheet: columns collection, place, owner, encryption rest/transit, who has access, retention, deletion procedure. For a store start with the Magento database (customer_entity, sales_order), session Redis, env.php, the media bucket, the PBS datastore.
VM disk: LUKS or ZFS encryption. MariaDB: require SSL on the application account, a user with rights only to the store schema. Redis: bind on the internal VLAN, a password, not 0.0.0.0. Secrets: Git does not hold env.php. Magento setup:config:set in deploy from CI. PBS: a job for the store VM and the database, prune, a restore test on an isolated VLAN, a staging dump with masking (email, name, address replaced by a script). Panels: Cloudflare Access on Grafana, Proxmox 8006, adminhtml. MFA everywhere. Wazuh FIM on configuration paths.
After setup: a quarterly review of the sheet and a restore test. Service: data security.