I am writing a web service that handles financial data which needs to be protected. Currently, I am developing and debugging the service but start to think of the production environment.
It is possible to log the sent payload — the financial data — for debugging purposes. This is the only way for me to see whats going on as a developer. The log information is written to a log file with java.util.logging.
Do you have an idea how I could encrypt the log file? Or do you have any suggestions how to make this secure?
I think rather than encrypting the entire file you could just encrypt the sensitive data, while keeping the other logging information intact. In this case you may need to create decrypting program as well.
Or better if possible when logging the data just mask it (like credit card numbers are masked using X character) so that it will be impossible to decrypt but the developer will be able to have an idea about what happened there. As per S.L. Barth’s answer you could use built in encryption to do the encrypting.