Please start any new threads on our new
site at https://forums.sqlteam.com. We've got lots of great SQL Server
experts to answer whatever question you can come up with.
| Author |
Topic |
|
MirandaJ
Starting Member
35 Posts |
 Posted - 2008-03-21 : 10:20:53
|
| I recently had an issue with two junior developers that work for our company. They were planning on taking data and using it for nefarious reasons. The data they needed is encrypted in our databases but since they are developers they had access to the encryption routines and the keys used for the encryption. As a solution I thought about moving the encryption to a stored procedure that I will save in the master database. And allow execute for these accounts but no other access. Is this possible to prevent them from looking at the procedures in the master dataabse? Will this work to prevent data theft from inside the company? If this is a bad idea, what do others do to prevent theft of data from developers who need access to most of the code that will be used?Miranda |
|
|
mfemenel
Professor Frink
1421 Posts |
Posted - 2008-03-21 : 11:30:52
|
| This is a good case for a dedicated environment with only dummy data in it. Then keep developers paws off production ( a good idea anyway)Mike"oh, that monkey is going to pay" |
 |
|
|
MirandaJ
Starting Member
35 Posts |
Posted - 2008-03-21 : 11:42:18
|
quote:
Originally posted by mfemenel
This is a good case for a dedicated environment with only dummy data in it. Then keep developers paws off production ( a good idea anyway)
We do have a development server where all development is done, and a production server where the real data is stored. However, the encryption routine is the same on both servers. I would love to limit the access to just development but there are times when issues will arise (bug fixes) and any new programmers I hire will need access to the live data.Miranda |
|
|
|
rmiao
Master Smack Fu Yak Hacker
7266 Posts |
Posted - 2008-03-21 : 17:19:36
|
| You can let developers work on dev server for fix and you apply it on prod server. |
|
|
|
|
|
|
use master db to prevent internal theft?