Download eBook (PDF) - Red Gate Software

10 – Layering SolutionsDevices and methods that protect data externally from the database, such asfirewalls, secured network connections and user interface cryptographymethods, are important for a broader security solution that involves data intransit.Educate, Educate, EducateOnce the sensitive data has been secured within the database it is important toeducate the users on how to recognize sensitive data and how it should andshould not be communicated. The users will be the target for those who aim tocircumvent your security efforts through social engineering and phishingattempts. These efforts to glean sensitive data can come from an external aswell as an internal source.Strong sensitive data handling policies, enforcement of these policies andcontinual education are the keys to protecting the data that has been entrustedto your business, to protecting the reputation of your business and, mostimportantly, protecting your customers.ConclusionIn this book, we have explored the basic concepts of protecting sensitive data inSQL Server, and executed them against a sample HomeLending database.Through this exploration, we have learned that all data is not created equally.There are many contributing factors that determine the sensitivity of a givenpiece of data. Regulations, industry standards and corporate policies are majorresources in determining the sensitivity of data.We have also learned that identity theft prevention, customer privacy,compliance with regulations, national security and even the survival of ourbusinesses are some of the motivating factors that will result in theimplementation of the measures discussed in this book.The process of defining our sensitivity classes, evaluating each column in ourdatabase and assigning these classes to each of them provided us with theability to apply the appropriate security measures and data handling policiesconsistently. The extended properties feature of SQL Server allowed us todocument our data classification efforts. Through the use of catalog views andsystem stored procedures, the status of our classification definitions can berecalled on demand.204