When attackers gained access to personal information on 19,000 students at Carnegie Mellon University last April, business and network administrators there began a systemwide review of data policies. As a result, the university drastically reduced its use of Social Security numbers (SSN) and implemented new security-management controls around its Oracle databases. But when it came to protecting data extracted from a database, Joe Jackson, system architect at the school, was at a loss.
"Controlling the utilization of unstructured data is incredibly challenging, because once that data's out of the database, controls don't work," he says.
Centralized database security management and auditing is a good first step. But organizations should also protect the safety and integrity of data at other points.
The article continues at