Securing fields

[David Lozzi]

Howdy,

I'm planning on storing credit card numbers in my SQL database for online
ecommerce. Whats the best scenario to secure the data in SQL? Can I encrypt
the field so if browsing table data it won't appear? Of course i'm using SSL
for capturing the data from the website, sending it SQL. the SQL database
has limited logins and access but I want to protect this information as best
as I can.

Thanks,

--
D a v i d L o z z i
Data & Web Technology Specialist
Delphi Technology Solutions, Inc.
Wilmington, MA
dlozzi@(remove this)delphi-ts.com - www.delphi-ts.com

 

[PeterKellner]

Howdy,

I'm planning on storing credit card numbers in my SQL database for online
ecommerce. Whats the best scenario to secure the data in SQL? Can I encrypt
the field so if browsing table data it won't appear? Of course i'm using SSL
for capturing the data from the website, sending it SQL. the SQL database
has limited logins and access but I want to protect this information as best
as I can.

Thanks,

Great idea to encrypt it in the server. I wish more companies would
do this. I'm not sure if you asking whether you should, or how you
should. If you need help on the how side, the book Pro ASP.NET 2.0
2.0 in C# 2005 by Apress has a great example of doing exactly what you
are looking for on page 859. Their source is probably on line also.
(it's chaper 25)

good luck
Peter Kellner
http://peterkellner.net

 

[David Lozzi]

Yes, its more of a How than a Should. I'm working on .Net 1.1.

--
D a v i d L o z z i
Data & Web Technology Specialist
Delphi Technology Solutions, Inc.
Wilmington, MA
dlozzi@(remove this)delphi-ts.com - www.delphi-ts.com

 

[Steve C. Orr [MVP, MCSD]]

I would advise not storing credit card numbers in your database at all, that
way it's impossible for any one to hack in and get them. After the credit
card number is processed, throw it away.
If you MUST keep it, definitely encrypt it. SQL Server 2005 has built in
encryption functions you can use.

Otherwise you might choose to use some .NET 1.x encryption techniques, such
as these:
http://www.aspnetpro.com/NewsletterArticle/2003/10/asp200310kd_l/asp200310kd_l.asp
http://www.fawcette.com/vsm/2003_01/magazine/columns/gettingstarted/

 

[prabhupr]

Hope this helps

http://blogs.msdn.com/lcris/archive/2005/06/10/428178.aspx

Thanks
PP