I'm developing a web application with a strong focus on security. What measures can be taken to prevent those who work on the application (programmers, DBAs, quality assurance staff) from capturing user entered values that should be well-protected, such as passwords, social security numbers, and so forth?
This is quite simple. Banks do it all the time.
You have three groups of people involved. These are security groups. With distinct authorizations.
Developers cannot assign security authorizations and cannot see production data.
Operators cannot assign security authorizations and cannot create software.
Security folks who set the authorizations and can neither create software nor operate the software.
The developers create software. The operators install it and operate it. The security folks assure that the two groups are kept separated.
|show 3 more comments|
The programmers don't have access to the production servers. But someone has to have access. There's no way around it. And there's always a chance that someone may go insane and abuse their access.
Data that is hashed/salted is theoretically secure even from the people who have full access to view it. But most data is not appropriate for hashing.