RE: [PHP] Storing Social Security Number WAS: Encryption/Decryption Question

At 5:30 PM -0700 8/11/10, Daevid Vincent wrote:
>  > -----Original Message-----
>>  2. Were told it was a social security number
>>     (i.e., in the form of 123-45-6789).
>
>Stop.
>
>Why are you even contemplating storing SS# ??

Daevid et al:

Why? Because my client wants to store SS numbers on their online 
system to aid them in their collection business.

You see, the client in this case is not asking people for their SS 
numbers, but rather trying to collect unpaid debts. Their clients 
(i.e., creditors) have provided them debtor data, which may/may not 
include SS numbers.

My current thoughts are that the entire process will be behind a 
password protected section of a web site where only the people 
working for the firm will have access. The point of the system will 
be to aid collectors in their collection efforts and to allow them to 
conduct business anywhere they can find Internet access.

Of course, this will not stop employees from abusing the data, but 
that possibility also exist in the hard-copy only office as well -- 
that's a criminal act and will be handled accordingly. The difference 
here is that the data can be accessed online via password 
authorization. Is that too easy?

My effort here with my "Encryption/Decryption Question" is to focus 
on the event that the web site may hacked and access to the database 
is provided to an intruder. In such case, then the SS numbers 
residing there should be encrypted and that was my current quest to 
resolve.

Now, if federal law prohibits storing SS numbers in an online 
database that's accessible via password authorization then that's 
"end-of-story". I'll simply tell the client that federal law 
prohibits such practice and that will be the end of it -- it makes no 
difference to me.

However, if the practice of storing SS number online is not 
prohibited by law, then what are the appropriate "due diligence" 
steps necessary to protect such data?

Cheers,

tedd

-- 
-------
http://sperling.com/