We have 3 access databases that are completely confidential and several years old. Currently the way I have it set up is, I have the 3 databases on our 2k3 file server. Only one person has access to these files and nearly has full control of the files in the sense that he can read/write/delete to routinely update these databases. I also have a daily scheduled back-up to back-up the databases to the local C: drive of the file server, which ofcourse no one else has access too.
Ultimately, what I am planning to do is cut access to his CD, USB, and floppy drives, which I'm all perfectly aware on how to do. This is a limit to some extent of transferring the files elswhere but I still am worried about UNC transfers, since even if I cut access to the workstation's C: drive, you could still transfer thes databases directly from the file server to another workstation that DOES have access to their C: drive. Also email attachments (powered by exchange 2k3) is another issue.
Database passwords would prevent other employees from somehow getting these databases, but the real concern is if the said person that updates these databases decides to leave the company and take these databases to a competitor, he would ultimately have the ability to do so since he obviously knows the passwords.