Informix database security

Path: emory!swrinde!cs.utexas.edu!uunet!iWarp.intel.com|ogicse!psgrain!m2xenix!quagga!ucthpx!oct1!aim1!chan From: chan@aim1.UUCP (Neville Chamberlain) Newsgroups: comp.databases,comp.databases.informix Keywords: database security informix Message-ID: <53@aim1.UUCP> Date: 15 Oct 91 05:39:11 GMT Organization: Aztec Information Management Here's an interesting scenario: A retail chain are installing a number of Unix systems at their branches to handle point of sale, ordering, etc. Among other things, the systems will contain confidential information relating to each branch, e.g. personnel info. This info has to be kept private and access limited to only selected persons. The database system being used is Informix with the standard engine; applications have been developed using 4GL. The problem with security is that the chain has to give one person at each branch root access to the system in case the network/modem support lines fail; this person will obviously have permission to do almost anything on the system. I do not think the chain are too worried about the persons with root access; but others might get hold of the root password and, if they can get hold of the relevant info, use it for their own nefarious purposes. THUS: How to protect the confidential information on the systems? The following suggestions have been made: a) Enforce strict security and auditing on the systems. This will warn of unauthorised accesses, file opens, etc. Nice but always too late. b) Modify all reads and writes to the relevant tables to encrypt and decrypt the data before it is written/after it is read. Means that the application programs (already in existence) have to be modified. c) Ignore the problem. The people at the branch outlets are not programmers or Unix experts, either of which is required to get to the data. d) Encrypt/decrypt the relevant tables after and before use. This means that while certain applications are running, the info is "freely" available. e) Combinations of the above. Any help/suggestions appreciated! I will summarise if there is enough interest. -- ............................................................. Neville Chamberlain :Tel: +27 (21) 419-2690 Aztec Information Management :Fax: +27 (21) 21-1040 chan@aim1.UUCP