Sensitive Data & the .NET Crypto API

摘要

Criminals are prowling the Internet looking for data to steal. Will your data or your customers' be next? The bad guys don't care about data security laws, but software professionals need to know their legal obligation to keep customer data private. Properly using the .NET Cryptography API is an effective way to safeguard sensitive data. In this article, we show you how to choose the right crypto algorithm, generate keys and initialization vectors, and encrypt/decrypt objects and byte arrays. We also include a sample application that demonstrates these techniques. If sensitive data is stored on a hard disk, in a database, or in any other persistent format, it is imperative to encrypt it with a strong encryption algorithm. Even if your organization controls physical access to your data center, private data can leave the data center in a variety of ways. Backups are often stored in offsite locations. Computers are shipped off for repair or disposal, In a study entitled "A Remembrance of Data Passed," two MIT graduate students analyzed 158 hard drives purchased on eBay. Of the 129 drives that were functional, 74 percent contained easily recoverable data including financial records, medical information, e-mail correspondence, and thousands of credit-card, numbers. Only 12 of the disks were properly erased (see http://web.mit.eduewsoffice/ 2003/diskdrives.html).