[salshehri]

Hey
I’m a master student in IT, concentrating in networking and databases and would like a dissertation topic in database security.

Thanks in advance,

[chuckhole]

In what country? In what business?

The requirements for database security have two goals to accomplish. One is to meet the business needs and the second is to meet legal requirements. This varies for private and publicly traded companies.

If this is the United States or a company that is headquartered in the United States then there are a couple of laws that directly effect the requirements on database security. They are the Sarbanes-Oxley Act and the HIPPA. Sarbanes-Oxley (also known as the Enron law) attempts to safeguard the stockholders by ensuring that financial records are reported in a truthful manner. The law has filtered into so many other areas which includes a significant impact to the Information Technology field. The second is primarily for guaranteeing the privacy of records for Hospitals and Insurance companys. But since so many different business types purchase insurance (including medical) and some of the larger companies are self-insured, the company records fall under the same legal guidance. Then there is the Human Resources, Health/Safety and Environmental, and Payroll data that has to be kept confidential to safeguard against identity theft and ensure privacy.

As far as business needs are concerned, the rules are much simpler. Keep sensitive or vaulable data away from employees that should not see it or from being extracted and sold to the highest bidder.

Our large offices and manufacturing plants in other countries have to also follow these same laws and also must follow the laws of the country we are doing business in. It can become confusing.

Database security is a broad subject. You have your work cut out for you.