WebApp Sec: Re: storing SSNs, CCNs, password in the DB

[Alvin Oga <alvin.sec () Virtual Linux-Consulting com>]

hi ya

> What is the most secure way to store SSNs, CCNs, and passwords in the
> DB?
the place where senstive info is stored should be using an encrypted fs
where data is encrypted/decrypted on the fly per inquiry

change keys often and that it only works from certain machines
and certain accts

> Is this a good general policy?
assume that the cracker is watching everything, including your keystrokes
and protect your data accordingly ... and audit your hardware too

c ya
alvin