Download eBook (PDF) - Red Gate Software

1 – Understanding Sensitive Datatype of data that is protected on grounds of national security. Other data in thisrealm may include trade agreement details, scientific discoveries that haveglobal consequences if disclosed improperly, and the schedules of key figuresof the government.During World War II, the popular slogan of "Loose lips sink ships" remindedcitizens that sharing even seemingly harmless information could have direconsequences to the troops that were fighting in the war. The informationprovided in the letters sent to the troops from home could have fallen intoenemy hands and been used against the allied forces' efforts on the frontline.What was true of wartime letters is also true for sensitive data that is stored indatabases.If you are a DBA within the military or government, or a civilian business thathandles data from the military or government, you need to have a clearunderstanding of the data handling policies that have been established by themilitary or government agency in order to protect this special form of sensitivedata.Compliance with RegulationsFederal, State and local governments establish laws and guidelines that pertainto sensitive data. Some of these laws are industry specific, such as the UnitedState's Financial Privacy Act of 1978, which pertains to data that is specific tofinancial records and account information of a financial institution's customers.Others are broader in their scope, such as the United Kingdom's DataProtection Act of 1998, which pertains to any entity that obtains, stores anddiscloses sensitive data.Compliance of laws and regulations are monitored through regulatory agenciesand audits. The consequences of non-compliance range from denial of abenefit, to the levying of significant fines and, in some situations, prison terms.In addition to governmental regulations are standards that are defined byindustries. These industries enforce compliance with these standards in theprovisions and to utilization of their services. Many of these laws, regulationsand standards define how sensitive data is to be stored and disclosed.An example of such a standard is the one developed by the major credit cardcompanies, called the Payment Card Industry Data Security Standard (PCIDSS). Requirement 3 of the PCI DSS designates the card holder's name, theprimary account number, expiration date, service code and the authenticationdata as being sensitive data and defines how this information is to be stored andprotected. The PCI DSS specifically states that encryption, hashing or23