Re: Securing sensitive information

On Thu, Aug 29, 2002 at 20:42:05 +0900,
Jean-Christian Imbeault <jc(at)mega-bucks(dot)co(dot)jp> wrote:
> I've scoured the web and can't seem to find any definitive on how to
> secure sensitive information in a DB, postgresQL in particular.
>
> Most suggestions rely upon encrypting the data. This is all fine and
> well except for the one nagging question I keep having: how do you
> protect the password that is needed to decrypt the data? Maybe I'm
> missing something?
>
> Can anyone recommend any good web documents on how to secure sensitive
> information?

Who are you trying to protect the data from?
If it is from the system administrator or DBA, that is going to be tough.
If it is database users, you may be able to force access through views
that restrict visible tuples to those each user is supposed to be able to see.

I also have read some other tricks like indexing data by hashes, so that
if you know something about the data (perhaps a last name), you can
compute the hash and use that to retrive the related information.