Protect data from DBA at database level??

[Axr2]

Is it possible to protect sensitive data from a DBA at a database level using something besides FGAC, dbms_obfuscation and auditing??

I have a potential client who was telling me that all major financial customers that operate under HIPPA security use some tool to do this. The guy wasn't able to give me the name of the tool..but that's another matter!

I've never maintained databases for major financial institutions. Can someone shed some light? Are there some 3rd party tools available to do this stuff?

[Dilippatel]

possibly you can encrypt the confidential fields. Check for Oracle 9i New Features, u may find some solutions.

[SANJAY_G]

Originally posted by Dilippatel
possibly you can encrypt the confidential fields. Check for Oracle 9i New Features, u may find some solutions.

Just wondering.. Can this encrypted data be hacked through logminer ??

[Axr2]

Just about everything in the database is supposedly sensitive. Encrypting fields is not feasible.

Anyone out there managing databases for major financial institutions (banks, mutual funds, etc)? What's the norm?

[patnams]

Revoke DBA privileges from the DBA

I wonder how feasible is it to store all data in encrypted format?

Just a vague/stupid idea, how about granting all the privileges in the DBA role, then revoking (SELECT, DELETE, UPDATE, INSERT ) ANY TABLE privileges. This will enable the dba to any operation but not see data. Of course you will need a SUPER dba who will do this, again she/he can see data, so no point.

[SANJAY_G]

Originally posted by patnams
Just a vague/stupid idea, how about granting all the privileges in the DBA role, then revoking (SELECT, DELETE, UPDATE, INSERT ) ANY TABLE privileges. This will enable the dba to any operation but not see data. Of course you will need a SUPER dba who will do this, again she/he can see data, so no point.

You think a DBA can't re-grant them to himself ???

[abhaysk]

You cannot avoid a DBA from seeing any schema's data, if you can do so then he is not a DBA

[DaPi]

Originally posted by Axr2
Anyone out there managing databases for major financial institutions (banks, mutual funds, etc)? What's the norm?

Wouldn't know about the norm, the answer seems to be: have a DBA you can trust - not one you just hire "off the street"

http://www.dilbert.com/comics/dilber...2296040720.gif

http://www.dilbert.com/comics/dilber...3486440721.gif

[Nighthawki]

Oracle provides a package to encrypt table data, I can't remember it's name at the moment...
Try searching in the Oracle 9i ref.
I highly doubt it can be hacked, just as you can't hack the package body encryption... (many have tried).

[davey23uk]

its dbms_obfuscation, but the OP said he didnt want / cant use that