Comment on Denver Police Caught Misusing Databases Got Light Punishments, Report SaysparentComments−tajen10yI'm interested to know how your system ensures that anyone accessing PII goes through the system. Don't sysadmins have full access to the db? When you are granted access, can you see the full table or just the row about this user?−Retric10yIt's not that hard to keep all PII encrypted in the DB. Ideally, PII should only be decrypted inside your application.Though at a minimum https://en.wikipedia.org/wiki/Transparent_Data_Encryption should be used.
Comments
I'm interested to know how your system ensures that anyone accessing PII goes through the system. Don't sysadmins have full access to the db? When you are granted access, can you see the full table or just the row about this user?
It's not that hard to keep all PII encrypted in the DB. Ideally, PII should only be decrypted inside your application.
Though at a minimum https://en.wikipedia.org/wiki/Transparent_Data_Encryption should be used.