Need Direction on WHAT to Implement...

Please understand that I am not asking HOW to do something - but, rather, I
just need some advise on what "technology" or method I should employ...
The problem is this:
I have a client for whom I am developing a web site. The client is a bank -
therefore, the entire site will be secure (SSL).
The banks' customers will be entering account number information to the
site - and we will be storing all inputs into a SQL Server database. The SQL
Server database resides on one of OUR servers.
The bank client then wants to periodically download, on demand, the
information that its customers have entered. (And the bank wants to download
the information entered in Excel spreadsheet format.)
I need to determine how I am going to get the entered information from our
ASP.NET server to our SQL Server database in a format that will be
unreadable to us (me, my company).
Likewise, I need to make the information available to the bank to download
in a format that they CAN read.
Where do I start'
I am an experienced, MCSD.NET certified developer - and I can implement
anything.
I just need to know where to begin.
Many thanks for your assistance!
~ Celia ~?
I am an experienced, MCSD.NET certified developer - and I can implement
anything.
"Celia Oblinger" <Oblinger@.comporium.net> wrote in message
news:b208a994.0401151834.259491a1@.posting.google.com...

quote:

---

> Please understand that I am not asking HOW to do something - but, rather,

---

I

quote:

---

> just need some advise on what "technology" or method I should employ...
> The problem is this:
> I have a client for whom I am developing a web site. The client is a

---

bank -

quote:

---

> therefore, the entire site will be secure (SSL).
> The banks' customers will be entering account number information to the
> site - and we will be storing all inputs into a SQL Server database. The

---

SQL

quote:

---

> Server database resides on one of OUR servers.
> The bank client then wants to periodically download, on demand, the
> information that its customers have entered. (And the bank wants to

---

download

quote:

---

> the information entered in Excel spreadsheet format.)
> I need to determine how I am going to get the entered information from our
> ASP.NET server to our SQL Server database in a format that will be
> unreadable to us (me, my company).
> Likewise, I need to make the information available to the bank to download
> in a format that they CAN read.
> Where do I start'
> I am an experienced, MCSD.NET certified developer - and I can implement
> anything.
> I just need to know where to begin.
> Many thanks for your assistance!
> ~ Celia ~

---

|||You could create a SQL DTS package that would extract the data from SQL and
put it into a new Excel Spreadsheet on demand.
Take a look at some examples out on http://sqldts.com
Then just use SSL between IIS and SQL to protect the data. The data will
not however be encrypted in SQL. You'll need to use third party tools to
do this.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.sql

Need Direction in WHAT to Implement...

Please understand that I am not asking HOW to do something - but, rather, I
just need some advise on what "technology" or method I should employ...
The problem is this:
I have a client for whom I am developing a web site. The client is a bank -
therefore, the entire site will be secure (SSL).
The banks' customers will be entering account number information to the
site - and we will be storing all inputs into a SQL Server database. The SQL
Server database resides on one of OUR servers.
The bank client then wants to periodically download, on demand, the
information that its customers have entered. (And the bank wants to download
the information entered in Excel spreadsheet format.)
I need to determine how I am going to get the entered information from our
ASP.NET server to our SQL Server database in a format that will be
unreadable to us (me, my company).
Likewise, I need to make the information available to the bank to download
in a format that they CAN read.
Where do I start'
I am an experienced, MCSD.NET certified developer - and I can implement
anything.
I just need to know where to begin.
Many thanks for your assistance!
~ Celia ~Celia,
One thought I have on this issue is to ensure the data stored in the SQL
Database is encrypted using a strong encryption package. There are several
good third party applications that can accomplish this objective for you.
The trick then is to control where and how the data can be displayed in an
unencrypted format. If the data is encrypted in the data files, the data
is not compromised even if someone obtains a copy of the mdf and ldf files.
Control of the decryption key is crucial.
Hopefully this information will get you started on the project.
Thanks.
Gary Whitley
This posting is provided "AS IS" with no warranties, and confers no rights.

need a way to secure RDL from being edited ?

Hi,
Is there absolutely no way at all that I can employ security on an RDL file
to stop users editing them ?
i.e design a report for a site, ship it, upload it to Rep Services (user on
site has admin right to machine - runs IIS and SQL internally). Is there no
way to stop someone opening the RDL in any RDL aware application and
amending it ?
Thanks for your time.
ScottScott,
You can easily secure the built in Report Manager web interface. Under
security properties for the Home directory, add your Windows login as a
Content Manager, then remove BUILTIN\Administrators. You can assign Browser
rights (and editing rights if you so desire) to the appropriate groups at
either the top level or lower down in the tree.
(I assume these users aren't accessing the RS web service directly from a
.NET application. That can be secured, but is a whole other ball of wax.)
Ted
"scott" wrote:
> Hi,
> Is there absolutely no way at all that I can employ security on an RDL file
> to stop users editing them ?
> i.e design a report for a site, ship it, upload it to Rep Services (user on
> site has admin right to machine - runs IIS and SQL internally). Is there no
> way to stop someone opening the RDL in any RDL aware application and
> amending it ?
> Thanks for your time.
> Scott
>
>|||Hi Ted,
Thanks for reply. I understand what you mean about securing the report and
dirs within the web interface but im more concerned about the actual RDL.
For example:
- I write a report and email it to a client
- they upload it into reporting services for users
- reporting services is running internally on IIS that also runs SQL server
- at least one admin user onsite will have admin rights to
sqlserver/iisserver/reportingservices machine.
If they have an RDL aware app they can amend the RDL. I would like to
secure the RDL from amending because:
1. it takes time and effort to write the RDL and we have a very complicated
db relationship structure.
2. we have to support the RDL files and if they have been amended it could
make it impossible.
Thanks for your time.