I have been given the task to rejuvenate an existing Human Resources application from Access into ASP.NET. This is a strictly internal application, and I have no problems developing it within our standard ASP.NET environment. It does however pose it's own problems, both technically and ethically.
The HR app will be responsible for storing employee pay data, for which it is not appropriate for me, the developer, to see. It's essentially three fields (salary band, actual salary, comments) and four other values, calculated on the front end.
I'd like to go down the cryptography route to encrypt said data - cryptography with the .NET Framework is very easy to implement. I could "roll my own", which as we all know is a bad idea. However I was wondering if there was a more better way of doing it. Here are some points:
- For starters, we're all attached to the same domain.
- I've heard and read about Certificates, can they be useful here? (x.509?)
- The data will be stored in our local SQL Server, obviously the actual data here needs to be encrypted, so can SQL Server help me? Certificates again?
- If a user doesn't have the appropriate certificate, can the data just be null? (You can't see this matey!)
- This encryption problem doesn't have any relevance to usage of the system via a permissions model.