Seeing the Sony Personal data kerfuffle unfold has gotten me thinking about the encryption and securing of personal data - obviously credit cards can (and should) be encrypted, making data breaches of this sort much less of an issue for the end user. That said even if customer credit card details are secure, the other personal data which can be leaked is potentially just as damaging. In this case the data leaked was:
- Your name
- Your address (city, state, and zip)
- E-mail address
In fact, in some cases this information can be more damaging - you can cancel your credit card with a single phone call, but the above combination of information still leaves you open to many forms of identity theft and it is far more difficult to change your address or name.
Hence my question: Is it feasible to protect customers personal details using encryption in the same way that credit cards are protected? (So that the effect of the entire database being compromised in this way are mitigated).
What about applications where searches are performed against this customer data? (for example to look up a customer by their name and address) Can the data be encrypted in a way that still makes searching possible and isn't prohibitively expensive in development costs?
Update: To clarify, I'm interested to know if there are techniques that can be used to securely encrypt personal details so that they are still "usable". For example it is a common requirement to be able to search for customers by their name or addresses, however this is potentially difficult to do if these personal details are encrypted. (Is it possible to reliably search on securely encrypted data?)