Many consider the insider threat to represent the greatest vulnerability and exposure to enterprise resources. This approach safeguards information by cryptographic protection from point-of-creation to point-of-deletion, to keep sensitive data locked down across applications, databases, and files -- including ETL data loading tools, FTP processes and EDI data transfers. This design principle optimizes placement of functions for encryption and security enforcement among the modules of a distributed computer system. The guiding concept, continuous protection of data, suggests that encryption functions placed at low levels, and typically implemented with native platform-based toolkits, may be redundant and of little value when compared with the cost of supporting them at that low level. The principle suggests that Enterprise levels of Data Protection and Key Management may be cost effective in many configurations. We also include a set of best practices that ensure not only a successful PCI audit, but a sustained improvement in the security and protection of sensitive data, and the limiting of theft and its costly aftermath.

You can implement ‘end to end’ encryption from within the database all the way in to your central systems by using an enterprise encryption key management system that is also supporting field level encryption in Files, Oracle, DB2 and SQL Server. I added links below to articles explaining best practices for the retail industry, PCI compliance and how to protect the data against internal threats. Please read more about available solutions in this wide area at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=934271 .