Can web site data be protected from access by the webmasters?

From: Skillman Hunter (ski@acrobyte.com)
Date: 06/29/02 

From: "Skillman Hunter" <ski@acrobyte.com>
Date: Sat, 29 Jun 2002 01:35:30 -0700

One of my client's was interested in a web site and has contracted with someone to do it.
The site basically is for magazine subscriptions.
I have advised the client to be wary of security.
The person doing the site for the client is in the same industry as the client's.
And that person is asking for the client's customer database.
"But I don't want to give out that information, it is worth it's weight in gold."
I replied "Who ever has control over the web site has access to all the information.
As time goes by, even without the current database, in a few years
as renewals accrue all the subscribers will be in the web database."
Client said "But it is going to be a SECURE web site."
I said, "Yes, secure to anyone that does NOT have access to the web pages and DB."
The web programmer involved is a friend of the person the client contracted with.
And client thinks that person is also the ISP.

Does anyone know of any way that a web site with SQL Server DB can be made
secure from the webmaster that created it?
A "secure" web site uses HTTPS/SSL encrypt the HTTP messages to and from the server
acting at the Presentation level of the socket software to prevent access
from outside the server, but not that the server DB would be encrypted.
I presume that data in SQLServer, or whatever DB is used can be encrypted.
But what happens to the data as it is tranmsitted to and from the DB to SSL?

Or one could not have a server DB at all and just have encrypted emails
sent to the client's office system - not efficient, but possible.

But I don't see that there could be any way to completely encrypt that data
in a way that the web site programmer or ISP would not have access to it.
Am I wrong?

I have advised the client to arrange for a third disinterested party to do the web site.

Relevant Pages

  • RE: HELP! Strange Problem with Internet Access after Migration
    ... Server, you cannot access your web site www.tapeandmedia.com, but other ... If you are using ISA 2000, there is a known issue when the internal client ... Since the internet computers can access the published web sites, ...
    (microsoft.public.windows.server.sbs)
  • RE: OWA Rendering Issue
    ... Clear the server and client cache. ... Open Internet Information Service Manager. ... Right-click the Default Web Site, ...
    (microsoft.public.windows.server.sbs)
  • Re: Published Websites in-accessable locally
    ... Do you mean that you can connect to the external machine ... Yes.I can connect the external machinefrom teh client without ISA ... connect to the external server. ... It is not recommended that host the web site on the SBS ...
    (microsoft.public.windows.server.sbs)
  • RE: Help! OWA Problems - Javascipt errors, and more
    ... Clear the server and client cache. ... Open Internet Information Service Manager. ... Right-click the Default Web Site, ...
    (microsoft.public.windows.server.sbs)
  • RE: Not able to connect to client from RWW page
    ... The issue is not user account setup, but the 2 of xp clients. ... mean any account is able to connect from that client through RWW. ... Right click Default Web Site, ...
    (microsoft.public.windows.server.sbs)