Re: Field Level Encryption - Best Practices

Do not store the key in same record as encrypted data!
Much of the complexity is in generating and storing keys.
If this project is to meet a particular standard (PCI, HIPAA, etc) then even though some standards are expressed in broad terms, make sure your design meets or exceeds those standards. Would suggest you also look at proposals to update the standards so that you can meet those now and not have to retrofit later.
PCI standard is pretty clear that encryption alone does not meet the standard.
Jim Franz
---- Michael Ryan <michaelrtr@xxxxxxxxx> wrote:

Looking for input. Embarking on a project to encrypt certain fields in
different files. My first thought is to have a shadow file containing
the encrypted fields, and then having a process to do
encryption/decryption as needed. I would blank/zero the fields in the
'master' file. I was thinking a shadow file because 1. - I wouldn't
have to change the format of the 'master' file; anmd 2. - I wouldn't
care about the difference in field length (encrypted/unencrypted).
Ideas? Thoughts? Thanks!
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.