Re: Implementing masking either via RCAC or encryption fieldproc

[Buck Calabro <kc2hiz@xxxxxxxxx>]

On 19 February 2018 at 16:08, Jon Paris <jon.paris@xxxxxxxxxxxxxx> wrote:
> Kinda misses the point of RCAC though Buck because it relies on the programmer not screwing up as opposed to being able to point the auditors (for SAX or whatever) at a system function.

I agree with you.  I probably missed explaining that we did this years
before RCAC became available.  There's no particular business case for
changing it to RCAC now, given the small number of screens we needed
to deal with.

> This is part of the problem we alluded to in our blog posts. You can't really just use RCAC to deal with a specific issue within an existing application - some reengineering is also required.

Yep.  'Spray on' security is harder than building it in.

  --buck