I have to jump in here. I work for the Department of National Defence. Talk about an employer with security concerns. For that, among other, reasons we have gone to Oracle for all but single user workstation based databases. The security used by Oracle is independant of the platform it is on. No one can get to the database server with Explorer unless they have an account on the server. This includes the authorised users of the Oracle databases on that server. Even if a user should learn the domain (real)name of the Oracle server and find it through network niegborhood, they cannot get on .Ok, a hard core hacker could find a way,but if he did, what would he do with the database? Just which of several dozen yadayada.ora files does he want? How will he read them without knowing the passwords to make them make sense? Even for the authorised users of Oracle, they can only see what we (Read I, as DBA) allow, and have no idea that data not immediatly related to their job lives in the same database. An aside, scince we moved one particular app over, many users think out IT dept are miracle workers, info they edit is usable by someone else with out having to e-amil over to them any more. Our orderly rooms now have correct and current info on their pers at all times, and not a clue as to how it is done. And security is strictly maintained throughout.