Generally speaking, putting sensitive data in a system that is accessible via the Web is a bad idea, Westin said.
Even if sensitive data is segregated and available only to authorized users, someone with access to the public portion of the database can find a way to break into restricted area, he said.
"If you want to keep data secure, don't put it online," Westin said.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
Read more about security in Computerworld's Security Topic Center.