certificate security

[adamroof]

Hello all,

Im reviewing developing SQL2005 encryption to store credit card information.

Ive setup a test environment and seems to work well, however im just a bit confused on the overall security using certificates.

I see that my data in the tables is actually encrypted, and can decrypt easily knowing the certificate to open. Now say a hacker gets in my database, whats to stop him from running the DecryptByKey? Where does the Master Key and password come into play? The hacker would know what key to open by looking at the stored procs.

It just seems that the encrypted data is a pointless step. If the mdf is taken i can see how the service key would protect it, which would lead to a DR question about recovery, but how does a cert protect the data from queries and prying developer eyes?

 

[bikerboy718]

I had the same problem at one time. After doing the research needed to solve this problem I found the it is better to encrpyt on the front end and pass back the encrpyted data to be stored in the database. That will cause a hacker to have to hack the front end application. Also how are you passing the credit card information to the database. Is it being encrpyted on the pass to the database?

With Great Power Comes Great Responsibility!!!

Michael