How can I provide decent security on this one to prevent someone grabbing the database (by local access - this machine is NOT Internet connected) ?
There is a lot you can do, but most of it is not directly database programming. Because most of this is not programming, it might be out of scope for you. I don't know what you were hired to do or what your background is. If this is out of scope or you don't feel comforatble implementing it, then let your client know your security concerns and recommend they hire a specalist.
- Hash the credit card numbers.
This depends on the purpose of the stored credit card numbers. If the number are only used to uniqely identify a customer or purchase then you don't actually need the credit card number, just a value that maps unqiuely to the credit card number. If this is the case then replaces the credit card number with a hash of the credit card number. Some hash algorithms: SHA1, MD5, RIPEMD-128/256.
- Delete the credit card number.
If at some point the credit card number is no longer needed, but the rest of the data in the row is, clear the credit card field. If you need to retain some indication of the card, but not for charging, then keep the last four digits.
- Break the database into pieces.
If you do not need to access the whole thing at the same time, break the database into pieces you need to access at the same time. If the entries are independent then break it into equal sized pieces. This will limit the damage if one piece gets lost or stolen. Try to load as few pieces at a time as is reasonable. If your application has only a few pieces accessible at a time this will slow down an unauthroized user.
- Store the keys off the machine.
There are a few ways to do this. One method is using a cryptographic token. There are USB devices, smart card devices, and software tokens. Software tokens can be stored on any removable media (CD-ROM, DVD, USB flah drive, etc). If you do break your database up into pieces, your might consider using different keys for some pieces, especially if some are used less frequently than others.
A salt is a random number typically used with hashed password entries to make it difficult for an attacker who accesses a password database to quickly find all the passwords in the database. PBKDF2 is a cryptographic algorithm which uses a salt and a password to generate a key. Generate a salt (random number) for each row and store the salt in plaintext in the row. Use PBKDF2 or another suitable key generation algorithm to generate a key for then row and encrypt the credit card data using the generated key. The purpose is to make the attacker read the database and generate a new key to decrypt each credit card number.
- Limit network access to the system.
You say the machine is not internet connected but I suspect it is still on an internal network. Use the firewall on the system to restrice network access to two or three other systems. If the system needs to connect to more than two or three other systems then you may need to think about moving the database to a different system or making a dedicated system for the database.
- Limit user access to the system.
Configure the security policy to allow only a few critical users to logon to the machine. If more than eight people need access to the machine, again that should be a signal that the database should be move to another system or it's own dedicated system. My quick though on eight users: System Administrater, System Administrator alternate, Security Administrator, Security Administrator alternate, Database administrator, Database administrator alternate, Application Developer, Application Developer alternate.
- Limit physical access to the system.
This is just the good old fashioned locked door. If it need to be in an area shared with other system try to make it systems that allow access to the same users. If all that is available is a closet or cabinet, just make sure that it has a unique key. A lot of office locks and furnite share common keys.
- Limit what users have physical access to the system.
Just because they need to access the machine don't mean they need physical access to the system. Choose who you give keys to, and instruct them not to make copies or lend it to anyone else.