Is there a way in the DB to hide data from the DBA?

[gorjant]

Hi,

I am a DBA and was given a task to check if there is a way in Oracle DB to hide some data from the DBA (user with SYSDBA privileges). For example a table that contains the salaries of the employees?

Thanx!

P.S. Without using encryption on the application level.

[DaPi]

Qui custodies ipsos custodiet?

[stmontgo]

dbms_obfusciation (check spelling) you can encrypt data

[JMac]

What we can OBFUSCATE we can DE-OBFUSCATE.

Have your employers ever heard of 'professional trust'? Or do all your accounts/finance department and payroll clerks wear blindfolds?

[JMac]

Just tell them you can use the DBMS_MAKE_INVISIBLE package.

Its annoyed me that post ...

[stmontgo]

I don't claim to be an expert in this but it appears you can hide the data using the DBMS_OBFUSCATION_TOOLKIT and then by using the app or the user the user to manage the keys.

http://download-west.oracle.com/docs...tool.htm#10272

I would say this could indeed be a valid concern with highly sensitive data and zealous auditors

steve

[slimdave]

Originally posted by JMac
What we can OBFUSCATE we can DE-OBFUSCATE.

Have your employers ever heard of 'professional trust'? Or do all your accounts/finance department and payroll clerks wear blindfolds?

DBA's have no need to see how much people get paid, nor their social security numbers etc. -- business staff do.

[BV1963]

Try to go your mechanic and ask him to fix you car but mention to hin that you can not give then they keys from the car and see what his reaction going to be.

[davey23uk]

being able to see what data is in there has nothing to do with being able to 'fix' it, how would you like it if your colleague was able to simply go and look at your salary or personal details?

Nothing wrong with hiding data from those who dont need to see it INCLUDING the dba.

[OracleDoc]

Ohh I can see this as start to a good debate! Might as well move this thread to the OBFUSCATE

This is what gets me, we as DBA's are soley responsible for companies data. With the typing of a simple statement we can plunge a company into potential bankrupcy. You have computer illerate managers in charge of DBA's who don't realize the power or responsiblity that we DBA's have. Besides it's called integrity /professionism. Yea I have access to all the "good stuff" but do I need to go there? No, so I don't.