Encrypting Salary value in ASP .NET 2.0 and SQL Server 2005

Question

I have an ASP .NET 2.0 website connected to a SQL Server 2005 database. The site is pretty simple and stores information about staff, including salary.

What is the best way to encrypt the salary value so no-one (including myself) can ever see what it is, except for the authorised staff using the web-app?

I don't want to encrypt / decrypt on the SQL Server because I could just run SQL Profiler to view the information, so I assume the encrypt/decrypt happens in the BLL on the web server?

Also, do I need SSL to stop someone sniffing HTTP responses between the browser and the web server?

Many thanks!

Anthony

Answer 1

SSL is probably your best bet to keep someone from sniffing, but be aware that it is still possible.

As for the other bit, SQL Server 2005 supports table-level encryption out of the box. Here's an article on it. You could create a SALARY table that is linked to an employee and keep that table encrypted.