Hi Tom,

What you've described as 'not a problem' sounds pretty complicated to me!

Also - 'keeping the keys with the data'..? I'm sure I've misunderstood, but why encrypt it at all...

Hi Anthony:

Just because the key is held away from prying eyes doesn't mean you can't test. It doesn't mean you can't decrypt data generally. Indeed, the only reason you'd store...

Storing the key on a backup (at least, a backup that anyone in the IT Dept can open and read) doesn't cut it if you're trying to comply with PCI...

If you want your systems to be PCI - DSS compliant (Payment Card Industry Data Security Standard, which is the standard the credit card firms pretty much insist you comply...

Doesn't the WWF have something to do with this type of thing?

http://msdn.microsoft.com/en-us/netframework/aa663328.aspx

(That's the Windows Workflow Foundation, not the World Wildlife Fund, or the wrestling.) 🙂

(I'm probably teaching my granny to suck eggs here, but...)

This is the fount of all knowledge with regard to Web Application security:

http://www.owasp.org/index.php/Main_Page

... plus it's really handy if you're...

Note I said "for the web"... I'm the fella here who has the happy job of monitoring the ever increasing volume of SQL Injection attacks that hit our sites every...

I'd try not to give a website account any rights over the underlying data at all, and only Execute rights over stored procs to access the data.

Am I doing the...

I meant that (as a relative begginer - certainly in terms of Database Admin if not design) it's actually easier to be introduced to a topic quickly at a high...

Hey- I've learned a whole lot from the discussion - more than I would have done if I'd had to skim read a much longer article.

I'm clearly a much less...

I thought the same... "Why would I ever need to delete 5,000,000 rows from a huge database table?" But then I thought "you never know!" It's not the sort of...

I like this forum!

I see. (I thought there would probably be a reason in there somewhere). Thanks.

There's no need to get all 'Comic Book Guy' about this. The example seems a bit muddled, but I thought the aside was actually quite a well made point.

The one...

I'm probably missing something here:

Why does that example do anything different to:

DELETE FROM tab1 WHERE col1 = 1;

???