Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

We're developing a travel/tourist application for a tours company who want to be able to input traveler information into an online database.

Is there any security best practice for storing passport numbers in a database? Should it be encrypted?

share|improve this question
    
Would you say passport numbers are more or less sensitive than, say, credit card numbers or passwords? –  Nick Chammas Nov 17 '11 at 16:31
    
also @NickChammas passport numbers and SSN? –  jcolebrand Nov 18 '11 at 17:29
1  
Relevant legal info searchsecurity.techtarget.com/answer/… –  Ben Brocka Nov 18 '11 at 18:01
    
@jcolebrand - Another valid comparison. Just leading the OP to see that passport numbers should be treated with the same security and gravity as these other pieces of information. –  Nick Chammas Nov 18 '11 at 18:34
    
I wonder why is it even necessary for a tour company to store the passport numbers. –  mustaccio Aug 24 at 21:00

2 Answers 2

Passport numbers should definitely be encrypted in the database. You should investigate the legality of collecting and storing this information before proceeding.

share|improve this answer
1  
Very good point about the legal requirements. –  mrdenny Nov 20 '11 at 11:13

As datagod points there's a legality component towards the practice of storing sensitive information such as a passport number. Where I live an active enforce of UK law Data protection act is the standard practice. But in other places like Chile is totally legal to store passport number which is the same as the ID (RUN), some websites even offer the possibility to retrieve a Passport/ID No by providing a full name.

So in a way I guess it would be better to search for local legislation in the subject.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.