My client has an Access 2003 "multi-user" (<6) "database" (<3k records) with "encryption" located in a LAN folder and an easy Form I polished with VBA(DAO library). Access 2003 encryption can be broken in less than a second with very easy tools. A decent level of encryption should be applied to the data (and maybe user control). My client needs an "easy" solution; something they can manage on their own (like they did with the access mdb file) without the help of engineers. Some computers have access 2003, some Access 2007 (so 2007's marvellous and straight forward encryption isn't a solution). Access 2003 refuses to connect to an access 2007 database via ODBC and also stores the passwords for linked tables in plain text (and doesn't ask for them).
I have thought of the following:
- Encripting individual fields. User generates a sha-512 hash that is substracted from every field to get the decrypted field. Problem: Manual editions of the Access table are common in this database.
- MySQL in a computer-server, they connect to the database via ODBC. Or SQL Express (seems better with Access). Problem: Someone has to configure and manage the server periodically. It seems disproportionaly complex given the scarce amount of data and the not frequent use of them. sqlite (which also has an ODBC driver) doesn't have good encryption, it seems. I believe a complex solution in their case would have greater security risks than a simpler one...
- A mdb file inside a zip file, the decription consists of extracting the file when they need to use it. Would solve the problem but is not elegant or safe enough (if a hacker went into the remote folder when the database is opened he would gain access to all the data). The file is only opened once or twice every day.
What do you suggest? Do you have another ideas? I have thought many times and it seems I'll have to go for SQL Express 2008; I don't like this solution. Thank you
