Please start any new threads on our new
site at https://forums.sqlteam.com. We've got lots of great SQL Server
experts to answer whatever question you can come up with.
| Author |
Topic |
|
wynng
Starting Member
8 Posts |
 Posted - 2006-06-08 : 04:47:47
|
| Probably not the best description for this query but.... How do people cope with the situation of support staff having access to sensitive information. For example they need full access to the box or full access to the server to be able to carry out admin duties but certain tables have sensitive information such as payroll. The only solutions I can think of are a)Encrypt any sensitive data, however this seems quite messy and would only stop the casual "snoop". b)Employ some form of auditing that reports on selects + updates to specific tables. c) Complete trust! Has anyone had any experience of locking down security to this degree? |
|
|
nr
SQLTeam MVY
12543 Posts |
Posted - 2006-06-08 : 05:46:43
|
| Depends how sensitive it is.You can have a separate box which does the encryption and the data has to be sent to that to be displayed. This would usually be a fairly simple piece of hardware which contains the encryption keys which no one person knows.When I worked on atm controller systems that's how we checked pins and passwords so that they never appeared in decrypted form outside the ATM.==========================================Cursors are useful if you don't know sql.DTS can be used in a similar way.Beer is not cold and it isn't fizzy. |
 |
|
|
|
|
|
SQL Access Monitoring