Question
EY
US
Last activity: 14 Apr 2016 21:26 EDT
Dose not want to store any personal identifiable data in pega like ssn/credit card info/dob
We have a requirement not to store any personal identifiable information(PII) data in PEGA like DOB/SSN No/credit card info/salary info how can we implement this in Pega.
Accepted Solution
Infosys
AU
Apart from suggestion made by Matthew, you might also want to consider marking these data as Transient data so that this PII data is not stored in any of the Pega tables:
Murali...
You can store them in the external DB used MD5 encryption with Salt.
http://stackoverflow.com/questions/1054022/best-way-to-store-password-in-database
Pegasystems Inc.
US
I would encourage you to consider stronger encryption than MD5 like SHA256 as MD5 has long been "considered cryptographically broken and unsuitable for further use." (Vulnerability Note VU#836068 - MD5 vulnerable to collision attacks). Also, you probably want to have the PII spread across multiple tables instead of consolidated into a single table to avoid having the compromise of a single table result in the compromise of PII.
Accepted Solution
Infosys
AU
Apart from suggestion made by Matthew, you might also want to consider marking these data as Transient data so that this PII data is not stored in any of the Pega tables:
Murali...