usernames distribution system - how to do securely?

[johnandrews]

Concisely, what's the normal way to distribute usernames; with an online lookup database?

I have a spreadsheet to distribute usernames to 200 staff in my company. They enter their surname and Social Security Number into a front-end interface. It looks up a back-end (stored on the network as a separate file) to find the username. Username pops up on the front-end.

The security isn't great. The files are passworded, to try and make them tamperproof, and so the user doesn't know where the backend is. Problem is you can hack it with VB, and download everybody's details.

Excel isn't ever going to be secure enough. Improvements are a sticking plaster.

There has to be an easy way of doing it. Where do I start?

Slightly off-topic, forgive me.

[Kyle123]

There isn't unless you're prepared to dump Excel

[johnandrews]

I am prepared to dump Excel (hence I'm a little off topic).

[Kyle123]

One way may be to put a simple web page together that reads the datasource and sends back the relevant data. The sensitive data therefore resides on a separate physical server that only allows external access through the web page.

Username's aren't usually so closely guarded though, it's normally passwords. You of course have to take into account additional security issues for example, how guessable are social security numbers? What if someone wrote a script to iterate and guess on surname.

[johnandrews]

Would normal HTML do it for the webpage? The browser will be IE8 (Java is OK, but no Flash/HLML5). It would be great to explore an online WYSIWYG/Java editor or something.

So long as a hacker can't download the entire database. A script isn't a serious threat. It is only accessible internally and needs surname and Social Security Number to work. Nor, oddly, can I just email/post them out.

[Kyle123]

No, you'll need a server language to read the datasource - there are loads out there, typically PHP, Ruby, Python, VB.Net, C#, Java and you'll need a web server.

The web server will depend on the server language you use, IIS for MS based development or Apache/nginx etc for the others.

By Java I assume you mean JavaScript? Java and JavaScript are very different things

[johnandrews]

Thanks.

Supposing I put a Java applet on the webpage, it then looks up a the server which decides what to send back. Because the smart bit is on the server (not a downloaded file, like before), the user can't get the whole database in one go. I've only uploaded files, not servers on my employer's network but I can look into that - the work computers aren't great.

Do any of them stand out as easiest for a beginner? I could develop on my Macbook Pro; the users will always be IE8.

I actually meant Java, but I suppose either could be applicable.

You're really generous Kyle.