Download eBook (PDF) - Red Gate Software

1 – Understanding Sensitive DataFor example, consider the Social Security Number, first introduced in theUnited States by President Franklin Roosevelt in 1935. Its initial intent was toidentify a tax payer who was paying the Social Security Tax. Attached to thistax are various benefits such as retirement and disability benefits. However,over the decades this number became much more widely used as a way fororganizations, businesses, hospitals and educational institutions to uniquelyidentify a US Citizen.Due to this extended usage, the unauthorized disclosure of the Social SecurityNumber opens up a Pandora’s Box of possibilities for fraudsters. The SocialSecurity Number is associated with credit reports, financial records, medicalhistory, criminal history, tax records, passports, birth certificates, publicrecords, voter registration, professional licenses and many other items that areused to validate identity.Laws have been enacted over the years at the Federal level, such as the UnitedStates' Gramm-Leach-Bliley Act, and at the state level, such as Indiana Code §9-24-6-2, in an effort to curtail use of the Social Security Number beyond itsintended purpose. However, there remain many legacy systems that utilize theSocial Security Number to uniquely identify a customer's record.As a DBA, keep an eye out for the use of any government assignedidentification as the primary key, or as a unique identifier, for an individual orbusiness. Strongly discourage the use of sensitive data for this purpose. It is farpreferable to use a system-generated value that does not have meaning beyondthe database, such as using an auto-numbering column or a GUID (globallyunique identifier), to define the primary key for a customer.Biometric DataUpon and within ourselves we contain data that can be used as a form ofidentity verification. This information is called biometric data. Persons whohave been severely burned are often identified through the use of dentalrecords. When data such as the number of teeth, their placement within themouth, the various types of dental work that have been performed on them, isproperly documented, it can be used to positively determine our identity.There are many ways to categorize the different types of biometric data but, ina nutshell, it can be lumped into two primary types: physiological andbehavioral.Physiological biometrics is the information that pertains directly to our bodies.These are the measurements of the tiny, and not-so tiny, features that make us25