RE: Encrypt data - SQL Server 2000

From: Fred Langston (Fred.Langston_at_guardent.com)
Date: 01/19/04

  • Next message: Cowperthwaite, Eric: "RE: About MS-Networking security." 
    To: 'Sasha' <nospam@mail.com>, focus-ms@securityfocus.com
Date: Mon, 19 Jan 2004 12:30:15 -0500

    For the payroll scenario, that's probably prudent. But if you're storing
    customer data that is not easily open to an inference-type attack such as
    that described, one-way hashes along with reversible encryption can be used
    to still have sorting and query abilities without doing bulk column
    decryption before Db querying. This can yield a significant performance
    boost with little increase in residual risk.

    Fred Langston, CISSP
      Senior Principal Consultant
      W: 206.903.8147 x223 F: 206.903.1862 M: 425.765.3330
      Seattle, WA www.Guardent.com
    ________________________________________
    G U A R D E N T
      Enterprise Security and Privacy Programs

    -----Original Message-----
    From: Sasha [mailto:nospam@mail.com]
    Sent: Monday, January 19, 2004 2:02 AM
    To: focus-ms@securityfocus.com
    Subject: RE: Encrypt data - SQL Server 2000

    On Fri, 16 Jan 2004, Kevin E. Casey wrote:

    > If you need to encrypt data in 3 columns and 3 columns only, your best
    > bet is to do the encryption at the application (in its data tier)
    > level. Using .NET (or other tools), gives you a good range/assortment
    > of tools and sencryption schemes to encrypt that confidential data.
    > This keeps your DBAs from snooping around. Keeps backup copies safe
    > from prying eyes and it also keeps the performance hit for
    > en/decryption at the client (or web server level).

    Just make sure that you use an encryption which do not produce the same
    result twice. That is if you always encrypt 50000 to ABCDE, it will be very
    easy to find which rows have the same value and thus who have the same
    salaries.

    Regards,
    ASK

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Cowperthwaite, Eric: "RE: About MS-Networking security."