Best Practices for handling sensitve data in the UI

[Bill Fuller]

Here is the scenario. We will be writing a web application that will need to
sometimes properly handle sensitive data (salary, ssn, profit, etc.) using
roles. This data will be restricted at a macro level (for example, no access
to accounting modules unless authorized) and a more granular level (no
visibility, read-only, and read-update to certain fields, such as personal
information, depending on role).

Question: Is there a good source of information on best practices for
handling this? For example, does it make sense to provide custom controls
for some/all of managed fields containing sensitive data?

[George Ter-Saakov]

I usually create "data class" that keeps all sensitive data takes 'security
level' as a constructor and exposes data using properties.
Like

class clsEmployee
{
void clsEmployee (int iLevel);
decimal Salary
{
get
{
if( iLevel != 1 )
return 0;
else
return _dSalary;
}
}
}

George.
"Bill Fuller" <so*****@nospam .comwrote in message
news:%2******** ********@TK2MSF TNGP04.phx.gbl. ..

Here is the scenario. We will be writing a web application that will need
to sometimes properly handle sensitive data (salary, ssn, profit, etc.)
using roles. This data will be restricted at a macro level (for example,
no access to accounting modules unless authorized) and a more granular
level (no visibility, read-only, and read-update to certain fields, such
as personal information, depending on role).

Question: Is there a good source of information on best practices for
handling this? For example, does it make sense to provide custom controls
for some/all of managed fields containing sensitive data?

[Bill Fuller]

Interesting... I like that idea. Simple and elegant.

Thanks.

"George Ter-Saakov" <gt****@cardone .comwrote in message
news:ug******** ******@TK2MSFTN GP06.phx.gbl...

>I usually create "data class" that keeps all sensitive data takes
'security level' as a constructor and exposes data using properties.
Like

class clsEmployee
{
void clsEmployee (int iLevel);
decimal Salary
{
get
{
if( iLevel != 1 )
return 0;
else
return _dSalary;
}
}
}

George.
"Bill Fuller" <so*****@nospam .comwrote in message
news:%2******** ********@TK2MSF TNGP04.phx.gbl. ..

>Here is the scenario. We will be writing a web application that will need
to sometimes properly handle sensitive data (salary, ssn, profit, etc.)
using roles. This data will be restricted at a macro level (for example,
no access to accounting modules unless authorized) and a more granular
level (no visibility, read-only, and read-update to certain fields, such
as personal information, depending on role).

Question: Is there a good source of information on best practices for
handling this? For example, does it make sense to provide custom controls
for some/all of managed fields containing sensitive data?

[sloan]

You should take a look at the CSLA framework for this specific need, as ~an
option.
"Bill Fuller" <so*****@nospam .comwrote in message
news:%2******** ********@TK2MSF TNGP04.phx.gbl. ..

Here is the scenario. We will be writing a web application that will need
to sometimes properly handle sensitive data (salary, ssn, profit, etc.)
using roles. This data will be restricted at a macro level (for example,
no access to accounting modules unless authorized) and a more granular
level (no visibility, read-only, and read-update to certain fields, such
as personal information, depending on role).

Question: Is there a good source of information on best practices for
handling this? For example, does it make sense to provide custom controls
for some/all of managed fields containing sensitive data?