Securing Enterprise Data in the Database

Sometimes protecting the communication channel to the database is not enough, and you may want to protect the data in the database itself. You can accomplish this protection by encrypting the data. There are two possibilities: symmetric encryption and asymmetric encryption.

Cross-reference

Chapter 4, Chapter 12, and Chapter 13 discuss symmetric and asymmetric concepts.

Symmetric encryption uses a key stored in the application to access the database and its data. This way if the database itself is compromised, the information is not available. The main requirement for this type of database encryption is that the application itself is secured. If the application is compromised, the attacker is able to obtain the symmetric key to decrypt the data. Asymmetric encryption uses both public and private keys. You use this method when you need to protect your data from both the database and the application being compromised.

Using encryption is expensive - the data needs to be decrypted before it is processed . This removes some of the advantages of using a database, such as being able to use SQL statements to perform searches. Setting database permissions goes a long way to protect your data from undesired requests .

In addition, you have the option to create a read-only or write-only database. For instance, many online stores use write-only databases to store credit card information.

Tip	You can establish levels of access in your database to prevent a user from accessing information that is restricted; a database view is commonly used for this. A view is a virtual relation that combines information from other relations.

The connection management to the database is frequently left to the application server. Chapter 29 presents some frequently used application servers and their security.

Table of content

Java Security Solutions

ISBN: 0764549286
EAN: 2147483647

Year: 2001
Pages: 222

Authors: Rich Helton, Johennie Helton

BUY ON AMAZON

MySQL Stored Procedure Programming

Identifying and Managing Project Risk: Essential Tools for Failure-Proofing Your Project

A+ Fast Pass

Adobe After Effects 7.0 Studio Techniques

Mapping Hacks: Tips & Tools for Electronic Cartography

GO! with Microsoft Office 2003 Brief (2nd Edition)