Download eBook (PDF) - Red Gate Software

1 – Understanding Sensitive DataThis data should not only be controlled in its disclosure to persons both outsideand inside the company. IT Professionals that are supporting the systems of theHuman Resources Department should not have access to plain text informationregarding their fellow employees. The temptation to run a query to comparetheir salaries to their co-workers is great and is an abuse of their role.As the gatekeeper of this information, the DBA should consider obfuscationmethods, discussed later in this book, to make this data unavailable to thosewho need to maintain the systems that contain this data.Communication DataThe fourth amendment to the United States Constitution states:"The right of the people to be secure in their persons, houses, papers, andeffects, against unreasonable searches and seizures, shall not be violated,and no Warrants shall issue, but upon probable cause, supported by Oathor affirmation, and particularly describing the place to be searched, andthe persons or things to be seized."It is in support of this amendment that the Stored Communications Act (SCA)was developed, which protects stored electronic communication data fromunauthorized access and destruction by the government, businesses or otherentities.In 2002, The Council of the European Union passed directive 2002/58/ECwhich specifically states in regard to the storage of electronic communications:"… Measures should be taken to prevent unauthorised access tocommunications in order to protect the confidentiality of communications,including both the contents and any data related to such communications,by means of public communications networks and publicly availableelectronic communications services ... The prohibition of storage ofcommunications and the related traffic data by persons other than theusers or without their consent is not intended to prohibit any automatic,intermediate and transient storage of this information in so far as this takesplace for the sole purpose of carrying out the transmission in the electroniccommunications network and provided that the information is not storedfor any period longer than is necessary for the transmission and for trafficmanagement purposes, and that during the period of storage theconfidentiality remains guaranteed ..."Data that is stored in a database, file system, or within an application thatconsists of communications between parties, should be protected carefully.Within these communications could reside other personal, identifiable and29