1

I have simple situation, we are in IT center and I need to develop a simple one form 4 fields that contains a salary field, I need the programmer of our IT center could not know the salaries of other employees when he checks the database and the application he created

1
  • which database are you using ? Feb 10, 2014 at 16:23

3 Answers 3

3

You have different options, consider that depending on the regulations what you want to do may be mandatory (i.e: Spain).

  1. This is as simple as creating a database with fake info but with the very same structure.
  2. Change the names of the employees in the database (and other ids), let them develop and then change them back.
  3. Make the developer and the dba sign a non-disclosure agreement and let them work with the original db.

I believe that the first option is the best, populating a database is an easy thing using an script or similar and they don't need to access the real information. The third option, if you are afraid only about regulations, is the easiest.

--- After the clarification I add:

You can use any method to store the data in the database, I believe that the easiest way is not using public/private encryption but using a normal password with bcrypt or similar (this will have less complexity and will prevent you from managing keys).

The problem using a password is that the data will be crypted with just one password and all application users may have to share it.

I believe that encrypting the information inside the database is not a good solution since it has many implications, what I would do is limiting and logging the access to that database and choosing a dba for it in which I can trust.

The developer, simply, doesn't need to access the real data, you can build your own database for tests and development.

4
  • Thanks kiBytes, but may be I did not make my self clear, the developper will develop this application and he is working in the same organization also the DBA and will keep fine tune it, so What I am look for is sort of public private encryption to let the data saved encrypted and the key is with the admin of the application not the developper nor the DBA and each user of the application can access his own data only.
    – user39814
    Feb 10, 2014 at 9:51
  • @user39814 Yeah but the developer and the DBA, eventually will need to access the data and verify it so they are sure that what they have done is correct. The same will happen if you have someone to test the application, he will need to access the cyphered and the uncyphered information to verify it. For that you will need "fake data" or "authentic data". Then, if you want, you can tell the developer and DBA that you want the stored information to be encrypted. But that will generate some dependencies like "changing the password/key" will "recypher" the data and others...
    – kiBytes
    Feb 10, 2014 at 11:29
  • ok, I ll go with you, we test the data with a fake data, but after the real data entered, how to encrypt it in away they could not decrypt it if they did the program and have the source code and the database
    – user39814
    Feb 10, 2014 at 13:26
  • Easy, once they have developed it, choose a password and don't give it to them. You can use bcrypt to cypher all the information inside the database. (Consider reading the answer again after the clarification).
    – kiBytes
    Feb 10, 2014 at 13:42
2

You can hide this information from the developer quite easily. The developer only works in a development environment, which does not contain live data. When they have built the app, they create a deployment package, which a separate person deploys to live. There are some difficulties associated with this - such as debugging application problems - but it is achievable.

It is much harder to hide such information from operations people, like the DBA. Your best approach is to split the data somehow, such an encrypting it and storing the key separately. This would at least require two people to collude to extract the data. In general, commercial organisations do not do this successfully, and given the recent NSA leaks, it seems government agencies don't either!

1

Having the developers work without access to data would be like letting them work blindfolded and with their hands tied.

But that doesn't mean that it has to be production-data.

Any serious software development project should have at least two independent, technically completely separated copies: the test environment where development happens and the production environment where real users are working. This separation is important to allow developers to test what happens when they create, alter and delete data without being afraid of any consequences for the production environment. Your test environment should have access to an own database which is technically identical to the production database, but which is filled with test-data.

Your test data could either be randomly-generated by a program, or you could use production-data and anonymize it. When you just replace all the names (and any other information which can be used to identify a person) but leave all other data as-is, you have data which is functionally identical to the production but does not violate anyones privacy.

1
  • I use MS sql server
    – user39814
    Feb 10, 2014 at 22:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .