MSDN talks about how credit card information could accidentally be logged during traces. But that same article explains that “known” Personally Identifiable Information is not logged.
What I’d like to know is if there is a way to ‘flag’ members of a DataContract as PII, to take advantage of the .net built-on capability of filtering out PII from traces and logs? I’m thinking the answer is “no,” because the user names and passwords the article references I suspect are part of authentication steps, rather than part of data contracts that follow authentication.
Even so, is there any kind of built-in .net attribute I can annotate a Data Contract or serializeable class members with, which means “hey, this is a security sensitive attribute, beware!”
I got the below blog that explains how to add [PII] attribute to data contract
http://blogs.msdn.com/b/martijnh/archive/2008/08/18/suppressing-personal-identifiable-information-pii-in-wcf-log-files.aspx