Re: Encrypt data - SQL Server 2000

From: Dark-Avenger (Dark-Avenger_at_comcast.net)
Date: 01/21/04

  • Next message: Marc Fossi: "SecurityFocus Microsoft Newsletter #172" 
    Date: Tue, 20 Jan 2004 23:49:49 -0600
To: focus-ms@securityfocus.com

    This may be too simple of a solution, but why not use
    RSA_public_encrypt() in the application that inserts or updates these
    fields, and RSA_private_decrypt() with access to the private key for
    privileged users that need to view the data?

    D-A

    >
    >-----Original Message-----
    >From: Eduardo.Ortiz@alderwoods.com [mailto:Eduardo.Ortiz@alderwoods.com]
    >
    >Sent: 15 January 2004 18:02
    >To: focus-ms@securityfocus.com
    >Subject: Encrypt data - SQL Server 2000
    >
    >Hello,
    >
    >We are implementing an Enterprise Data Warehouse. We already have data
    >regarding different business process. Now we need to include Payroll
    >data in our SQL Server (2000) database. Business users have specific
    >security requirements about this sensitive data. They want to secure the
    >following
    >information:
    >* Annual employee salaries
    >* Commissions
    >* Wages
    >This information is stored in two tables and are three different
    >columns.
    >We have already implemented a tight security schema for the server,
    >database and user groups (active directory), but business users want
    >more security. Now we are planning to encrypt the data (just these three
    >columns) in the database. I did not find any function in SQL Server to
    >encrypt data. I found a tool provided by Application Security Inc
    >(http://www.appsecinc.com) called DbEncrypt. Have you guys heard or
    >worked with tool? Do you any suggestion or recommendation to encrypt the
    >data?
    >
    >Thanks,
    >Eduardo Ortiz
    >
    >
    >
    >------------------------------------------------------------------------
    >---
    >------------------------------------------------------------------------
    >---
    >
    >
    >
    >
    >
    >---------------------------------------------------
    >This email from dns has been validated by dnsMSS Managed Email Security and is free from all known viruses.
    >
    >For further information contact email-integrity@dns.co.uk
    >
    >
    >
    >
    >
    >---------------------------------------------------------------------------
    >---------------------------------------------------------------------------
    >
    >
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Marc Fossi: "SecurityFocus Microsoft Newsletter #172"

    Relevant Pages

    • Re: Application security question
      ... you want to implement security. ... So you are protecting the database from direct querying and altering ... login credentials for the database from the application. ... Why encrypt the password? ...
      (comp.lang.java.programmer)
    • Re: SSN encryption
      ... >> We want to encrypt social security numbers in a database. ... address and SSN are always excluded. ... exposed if there were a breakdown in the other security precautions. ...
      (sci.crypt)
    • Re: Which is more secure RC2 or RC4 ?
      ... same database temporarily, until the order is approved manually and the ... obviously there are a LOT of security related issues that arise ... itself in order to decrypt the information, ... meaning if I encrypt the information using AES and a password driven ...
      (sci.crypt)
    • RE: protecting .NET assemblies from hackers
      ... try exposing a web service or a remote class.. ... So one thing to do here is use a code obfuscator to encrypt ... > edit data on basically every table in the database. ... >> other methods of security like domain authentication or using ssl. ...
      (microsoft.public.dotnet.general)
    • RE: Security - It Doesnt Seem Possible?
      ... Hackers gaining access ... to your code or your database do not necessarily have both. ... security failures are anomolies and not the norm. ... So i encrypt them as they sit in the ...
      (microsoft.public.dotnet.framework)