Re: Security Vs DBA ?

Wesley Loftis, Jr. wrote: > > In <53v3ag$9dq@cssun.mathcs.emory.edu> rridley@sin-apit.DHL.COM > (Richard Ridley) writes: > > > >I have a slightly 'different' question to ask regarding security and > >Informix. Suppose you have a Human Resource application which runs > >on Informix, and this application manipulates data like salaries, > >etc. > > > >Now, you have an Informix DBA, but would like *all* access to the > >database used in the above example to be limited to the Human > >Resources Manager only. Is this possible using Informix Online / SE > >version 5 or 7, without making the HR Manager the DBA ? > > NO. The DBA can always unload the data and look at in text format, > load into another DBMS, speadsheet, etc. Why stop at the DBA, the > payroll clerk and supervisor can also give anyone an unauthorized > increase. Yes it is possible. You need only to encrypt the data before storing it in to the tables. The downside to this is that you have to decrypt the data each time you wanted to look at it. This means that you cannot use standard SQL to manipulate or to select data which has been encrypted. This would also mean that you would have to probably enhance your application too. Not a simple task, but it does keep everyone honnest. -Mikey