0

I have a big giant database that is basically human resources related. As such, it contains all the PII in the world (SSN, medical related stuff, bank payment info, etc).

If you do not request PII access permissions on the database, PII fields return NULL. If you do receive PII access, everything is displayed in plain text.

As a user and not a database admin, how do I guarantee that the PII itself is secured at rest? I presume that when I log in with my PII viewing privileges, some transformation is done on the underlying data to make it human readable. How do I make sure that when its physically sitting on disk its NOT human readable?

Oracle has this description here and an example of using a java class to decrypt PII but it is murky about providing me a way to verify that decryption of the underlying values is happening under the hood before I see plaintext.

  • Please do not edit the question with your conclusion. Either post your own answer or add a comment. – schroeder Oct 26 '17 at 14:21
  • Your conclusion makes no sense, how can it be both "Oracle's encryption" and "stored in plain text"? And why would users need to set up their own wallet? Why do you think that a user would see a table-level column name? – schroeder Oct 26 '17 at 14:23
2

If you can look at the database, you can look at the actual tables and see that the data is stored in an encrypted format, or if its' stored in plaintext. You can also check that the entire database is/is not stored as an encrypted object.

If you have access to the source code for the software serving the database info you can check the logic in the function and see if it encrypts/decrypts data as it is entered into the database or removed.

If you have access to the server as a whole you can check that disk encryption is in use.

If you have access to nothing your easiest way to check is to see if the software used is listed as being compliant with HIPAA/PCI regulations, and see what their website or your systems' administrator can confirm to you.

At the end of the day without knowing what software serves you the SQL tables, and without having access to view the SQL tables, it's kind of an open-ended question that is probably best resolved socially rather than technologically - ask someone who knows.

  • Only user access via oracle SQL developer. When I use a SELECT it returns plaintext, which is why I want to find out if the data is encrypted before I request it with a SELECT statement. – Dylan Oct 26 '17 at 13:12
  • @Dylan you need to ask the db admins – schroeder Oct 26 '17 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.