I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend.
The application is to track employee's money they defer each paycheck, or month, to deposit into separate 'fund' accounts. (Think of it like putting $200 of your weekly check into a few different stocks).
The business side says "ALL DATA MUST BE ENCRYPTED!" which makes no sense to me, and makes basic queries (Especially for dates) unusable. That makes the utilization of a RDMS futile.
The only fields I would deem necessary to encrypt would be:
- Employee Information (Name, DOB, Hire Date, Address, etc.)
- Employee Beneficiary Information (Name, SSN Address)
- Account Number for in-house that could be tied back to an employee via payroll
Nothing else encrypted (In my opinion) does not deem these people's information at risk.
What can I tell business users to actually make them hear me out and believe me? These are executives / officers within the company, so a respectful tone would be appreciated!
*Edit:*The information is to be encrypted so DBA's cannot see it, even if they have access to it. I've already tried to bring up TDE. It is not an option.