Hi guys,
I have very confidential data in my database. I am trying to secure my data from dba.
I am a member of development team. We develop our software and delpoy in a server which has its own dba. We have limited control over the server.
In this scenario how can i deny dba of the server to lookup my data and deny making changes to them.
Is it possible?
Encrypt on the client side, only send and store encrypted data in the database.
In a SQL Server instance, sysadmin can do everything and can not be blocked.
Some thoughts... why is your team of developers more trusted then the single DBA who I assume is looking after more then one SQL Server box? Can you explain more please?
You can always encrypt all data that goes into the database.
However, a DBA will have full control on this data - he may not be able to decrypt it, but will be able to read it (in encrypted form), update it and even delete it. Nothing you can do about this.
You really need to rethink things - how can you work with a DBA you cannot trust? Most places will have service agreement that forbid DBAs from doing certain things. You need to rely on this kind of assurance if you don't think your DBAs are trustworthy.