Re: Can web site data be protected from access by the webmasters?

From: Morris Lewis (Morris@Holistech.com)
Date: 06/30/02 

From: "Morris Lewis" <Morris@Holistech.com>
Date: Sun, 30 Jun 2002 01:25:37 -0500

First thought: create a development database with junk data. The web
developer only needs to make sure the site produces correct output and
stores data correctly. Once the project's done, change the passwords and
load the real data. If the programmer needs to make changes later on, make
the changes to a staging server that uses the junk data. Then have a
disinterested third party make any changes to the production servers.

Second thought: write a contract with sufficient penalties if the programmer
divulges the information.

Here's a rule of thumb for cases like this: never hire anyone you can't
trust.

Morris Lewis
MCDBA, MCSD, MCSE, MCT, CTT+
President, Holistech Inc

"Skillman Hunter" <ski@acrobyte.com> wrote in message
news:#f4Cxe0HCHA.1748@tkmsftngp13...
> One of my client's was interested in a web site and has contracted with
someone to do it.
> The site basically is for magazine subscriptions.
> I have advised the client to be wary of security.
> The person doing the site for the client is in the same industry as the
client's.
> And that person is asking for the client's customer database.
> "But I don't want to give out that information, it is worth it's weight in
gold."
> I replied "Who ever has control over the web site has access to all the
information.
> As time goes by, even without the current database, in a few years
> as renewals accrue all the subscribers will be in the web database."
> Client said "But it is going to be a SECURE web site."
> I said, "Yes, secure to anyone that does NOT have access to the web pages
and DB."
> The web programmer involved is a friend of the person the client
contracted with.
> And client thinks that person is also the ISP.
>
> Does anyone know of any way that a web site with SQL Server DB can be made
> secure from the webmaster that created it?
> A "secure" web site uses HTTPS/SSL encrypt the HTTP messages to and from
the server
> acting at the Presentation level of the socket software to prevent access
> from outside the server, but not that the server DB would be encrypted.
> I presume that data in SQLServer, or whatever DB is used can be encrypted.
> But what happens to the data as it is tranmsitted to and from the DB to
SSL?
>
> Or one could not have a server DB at all and just have encrypted emails
> sent to the client's office system - not efficient, but possible.
>
> But I don't see that there could be any way to completely encrypt that
data
> in a way that the web site programmer or ISP would not have access to it.
> Am I wrong?
>
> I have advised the client to arrange for a third disinterested party to do
the web site.
>
>

Relevant Pages

  • Re: Help with first VB application - Data Entry form
    ... I assumed a desktop / winform client application ... time' stamp from the database machine - control machine ... ... problem solved - web server is control system. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Help with first VB application - Data Entry form
    ... I assumed a desktop / winform client application ... time' stamp from the database machine - control machine ... ... problem solved - web server is control system. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Remobjects v KBM
    ... >> client query components) follow from that. ... Then, connections can be created to say SQL Server, Oracle, Interbase and ... can then be created from the abstract dataset definition in 'customers' to ... implicitly - this makes your code not be database connection specific). ...
    (borland.public.delphi.thirdpartytools.general)
  • Re: Help with first VB application - Data Entry form
    ... stamp from the database machine - control machine ... ... unnecessary data to the client ... ... and when building a database independent UI / Client - Server application, ... JavaScript, for example) and thus, will get the time from the web server, ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Opinions needed about the best "Middleware suite" kbmMW vs. RODA
    ... kbmMW supports cross db in such way that all you need to do in your application is to set one property to switch to ... What one have to concentrate about is minimizing the amount of data moved from the app server to the client. ... C/S setup's usually have a quite active chatter going on between the client and the database, ...
    (borland.public.delphi.thirdpartytools.general)
Loading