SlideShare a Scribd company logo

Steve Jones - Encrypting Data

Download as PPT, PDF
Red Gate Software
Red Gate Software

This document provides an overview of encryption in SQL Server, including: - Transparent Data Encryption allows encrypting data at rest on disk for increased security. - Communications can be encrypted using SSL or IPSec to encrypt data in transit. - Hashing provides a way to index and search encrypted data faster than decryption. - SQL Server uses a hierarchy of keys including symmetric, asymmetric, and certificates to manage encryption.

Technology
1 of 63
Downloaded 18 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
Encrypting Data in SQL Server Steve Jones Editor in Chief SQLServerCentral, Red Gate Software #sqlinthecity
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
• What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys Agenda
What is Encryption?
encryption is the process of transforming information (referred to as plaintext) using an algorithm (called a cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information (in cryptography, referred to as ciphertext). - Wikipedia
Simple CiphersSimple Ciphers ABCDEFGHIJKLMNOPQRSTUVWXYZ DEFGHIJKLMNOPQRSTUVWXYZABC WKLV LV HQFUBSWHG
Simple Ciphers ABCDEFGHIJKLMNOPQRSTUVWXYZ DEFGHIJKLMNOPQRSTUVWXYZABC WKLV LV HQFUBSWHG THIS IS ENCRYPTED
Complex Encryption Results: ------------------------------------------- 0x00E2A26D824E22468392458DE6F450DA0100000025DE09E F3AD8D7C989E393BF9FE1368D04C1B9BEE086EFFDF6F77A F9E3A3B8142F23723D536C72C216D6F9B104A5E44A
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server memory SQL Server data files Backup files
Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SQL Server memory
Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SL Server memory SQL Server memory
Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server memory SQL Server data files Backup files
Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SQL Server memory
Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SQL Server memory
Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server memory SQL Server data files Backup files
Encryption Hierarchy
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
Communications • Encrypt the connection to/from SQL Server – Encrypt “the wire” • Two options – SSL encryption from SQL Server – IPSec encryption at the Windows host network layer.
SSL Communications • Install certificate on SQL Server, set the FORCE ENCRYPTION options – Yes = required – No = client option • Certificate must be valid based on the system time • DO NOT USE SELF SIGNED CERTIFICATES • All rules in BOL – Encrypting Connections to SQL Server – How to: Enable Encrypted Connections to the Database Engine
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
Transparent Data Encryption • TDE introduced in SQL Server 2008 • Protects the data at rest by encrypting the data on disk. – The transaction log is encrypted – Backups are encrypted (can eliminate compression) – Tempdb is encrypted for all operations. – Replication data is not encrypted – Filestream data is not encrypted
Transparent Data Encryption • Implemented with a simple ALTER DATABASE command ALTER DATABASE AdventureWorks2008R2 SET ENCRYPTION ON; GO • Encryption is handled by the Database Encryption Key (DEK) • Requires a Database Master Key (DMK) and a Certificate to protect the DEK • Backups of the certificate protecting the DEK are necessary to restore a backup.
Transparent Data Encryption
Demo Transparent Data Encryption
Transparent Data Encryption • Overhead is < 5% • Enterprise Edition only (not BI edition) • Value? • Third Party Tools
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
Hashing • “A hash function is any algorithm or subroutine that maps large data sets, called keys, to smaller data sets.” - Wikipedia
Hashing • SQL Server uses the HASHBYTES functions • CHECKSUM() or BINARY_CHECKSUM() can also be used. • other implementations using .NET/CLR are better. (see Expert SQL Server Encryption, Michael Coles) • SQL Server 2012 adds SHA2_256 and SHA2_512 algorithms.
Demo Hashing
Hashing orEncryption • Hashing is not really encryption – Decryption is not supported (usually) • Hashing is deterministic, encryption is not • Hashing is quicker • In general, a hash of searchable data can be used to allow indexing of encrypted data. – Caveat – Only hash the portion of the encrypted data needed for searching, e.g. last four digits of a credit card number. • Choose the strongest algorithm available in your version. – SQL Server 2008 – SHA1 – SQL Server 2012 - SHA2_512
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
Keys • Multiple Keys in SQL Server – Service Master Key – Database Master Key – Database Encryption Key – Symmetric Keys – Asymmetric Keys – Certificates
The Encryption Hierarchy
Service MasterKey • Service Master Key = SMK • The Service Master Key is created when it is first needed. No CREATE DDL • Secured by Windows DPAPI (default) • Accessed by Service Account for database engine, or a principal with access to the service account name and password
Service MasterKey • Must be manually backed up. BACKUP SERVICE MASTER KEY • Must be restored in a DR situation to open other keys secured by this key (Database Master Keys) • Can be regenerated if necessary. – This can cause data loss • Encryption is now AES
Database MasterKey • Database Master Key = DMK • The Database Master Key is created by an administrator (CREATE/ALTER DDL) • This is secured by the SMK and a password (TripleDES encryption in 2008, AES in 2012) • This can be secured by password only (DROP ENCRYPTION BY SERVICE MASTER KEY option)
Database MasterKey • Backup and restore using DDL commands BACKUP MASTER KEY RESTORE MASTER KEY • OPEN/CLOSE manually if not protected by the SMK • Attach/restore of an encrypted database requires the password for the DMK • You can alter the DMK to add SMK encryption after attach/restore
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
Symmetric Encryption • Like a normal key lock • The key that encrypts the data also decrypts the data
Symmetric Keys • Symmetric Keys are created in a database and are always in that database (cannot be backed up/restored) • Symmetric Keys are deterministic, and can be duplicated with the same creation parameters. • Symmetric keys require less resources than asymmetric keys, but there is still an additional CPU load from their use.
Symmetric Keys • The identity value always generates the same GUID for the key. These must be unique in a session. • The KEY_SOURCE and IDENTITY can be used to recreate a key. If you choose the same ones, and the same algorithm, you’ll get the same key • You can, and should, secure these keys with asymmetric keys
Demo Symmetric Keys
Symmetric Keys • The algorithm used is stored in the header of the encrypted data. • You can generate temporary keys for encryption/decryption • CREATE SYMMETRIC KEY #MyTempKey • Encryption with passphrases uses symmetric keys (TripleDES)
Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
Asymmetric Encryption • Asymmetric keys are unlike keys and locks in the real world. • Based on factoring very large prime numbers. • More secure than symmetric keys • Require more resources for encryption/decryption than symmetric keys
Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Key 1 0x26CD66B61E50369C BBDB42F484237370E0 2238EEAE588E06D00F 8D0C6FAB5C48F68639 ABB4003564CFB48A4 1BA373CFA411E99D3 AB31A1B7CE40CB35 0x26CD66B61E50369C BBDB42F484237370E0 2238EEAE588E06D00F 8D0C6FAB5C48F68639 ABB4003564CFB48A4 1BA373CFA411E99D3 AB31A1B7CE40CB35 Asymmetric Algorithm Key 1 0xE7A518047A8D3836B 76006D9CE04DA2F803 607A57CD7F9EE855FC 3451EB02A076F28DD6 14BA841AC756E52CFE C4006746480C8204D57 9083C4AD0D627CAD24
Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Key 1 0x26CD66B61E5036 9CBBDB42F4842373 70E02238EEAE588E 06D00F8D0C6FAB5 C48F68639ABB4003 564CFB48A41BA37 3CFA411E99D3AB3 1A1B7CE40CB35 0x26CD66B61E5036 9CBBDB42F4842373 70E02238EEAE588E 06D00F8D0C6FAB5 C48F68639ABB4003 564CFB48A41BA37 3CFA411E99D3AB3 1A1B7CE40CB35 Asymmetric Algorithm Key 2 Now is the time for all good men to come to the aid of their country
Asymmetric Encryption Key 1 – Private Key Key 2 – Public Key Keys 1 and 2 are paired and generated together. One is referred to as a private key and the other a public key. Only the user has the private key, but the public key is distributed to everyone
Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Anyone encrypts with Steve’s Public Key 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 Asymmetric Algorithm Only Steve can decrypt with his private key Now is the time for all good men to come to the aid of their country
Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Steve can encrypt with his private key 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 Asymmetric Algorithm Anyone can decrypt with Steve’s public key Now is the time for all good men to come to the aid of their country
Asymmetric Encryption Now is the time Steve can encrypt with his private key 0x26CD66B61E50369C BBDB42F48423737 Steve encrypts again with Andy’s Public Key 0x48385D8A87BD329FF 328E476BC234 0x26CD66B61E50369C BBDB42F48423737
Asymmetric Encryption 0x48385D8A87B D329FF328E476 BC234 Andy decrypts the outer message with his private key 0x26CD66B61E50369C BBDB42F48423737 Andy then decrypts with Steve’s Public key to verify the message is from Steve Now is the time0x26CD66B61E50369C BBDB42F48423737
Asymmetric Encryption • Use DDL to create asymmetric keys (CREATE/DROP/ALTER) • Can be created outside the server (FROM FILE option) – SN.exe (Visual Studio SDK) – Makecert (Windows SDK)
Asymmetric Encryption • You can encrypt an asymmetric key with a password. – This will be required for decryption – Not required for encryption • Asymmetric keys are usually used to encrypt symmetric keys, which encrypt the data. This balances security with resources • You can remove the private key (prevents decryption in that db).
Certificates • Certificates are asymmetric keys with additional metadata. • Expiration dates are not enforced by SQL Server – Administrators must decrypt/re-encrypt the data and remove the old certificates – Useful for marking the key rotation dates (query sys.certificates) • To restore certificates, use CREATE CERTIFICATE. • SQL Server 2012 increases the maximum certificate length to 4,096. • Always use the longest length you can.
Demo Asymmetric Encryption
Key Length • Use long keys • Use strong algorithms (MD5/SHA1 = bad) • DKIM attack on Google’s mail system* – 384 bit key cracked on high end laptop – 512 bit key cracked for ~$75 using AWS – 768 bit key could be cracked by large orgs – This changes all the time www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/ 58
The End • Questions? • Don’t forget to fill out your feedback forms • Resources at the end of the PPT • www.sqlservercentral.com/forums • www.voiceofthedba.com/talks
References • Encryption - http://en.wikipedia.org/wiki/Encryption • Understanding TDE - http://msdn.microsoft.com/en-us/library/bb934049.aspx • Hash Function - http://en.wikipedia.org/wiki/Hash_function • Rainbow Tables - http://en.wikipedia.org/wiki/Rainbow_table • Transparent Data Encryption – https://www.simple-talk.com/sql/database-administration/transparent-data-encryption/ • How to enable/remove Transparent Data Encryption (TDE) - http://blogs.msdn.com/b/batuhanyildiz/archive/2012/10/16/how-to-enable-remove-transparent-data-encryption-tde. • Sys.database_encryption_keys - http://msdn.microsoft.com/en-us/library/bb677274.aspx • TDE and Backup Compression - http://sqlcat.com/sqlcat/b/technicalnotes/archive/2009/02/16/tuning-backup-compression-part-2.aspx • Encrypting Connections to SQL Server - http://msdn.microsoft.com/en-us/library/ms189067.aspx • ENCRYPTBYCERT - http://technet.microsoft.com/en-us/library/ms188061.aspx • DECRYPTBYKEY - http://technet.microsoft.com/en-us/library/ms181860.aspx • DECRYPTBYASYMKEY - http://technet.microsoft.com/en-us/library/ms189507.aspx • DECRYPTBYCERT - http://technet.microsoft.com/en-us/library/ms178601.aspx • DECRYPTBYKEYAUTOASYMKEY - http://technet.microsoft.com/en-us/library/ms365420.aspx • DECRYPTBYKEYAUTOCERT - http://technet.microsoft.com/en-us/library/ms182559.aspx
References • HASHBYTES - http://msdn.microsoft.com/en-us/library/ms174415.aspx • CHECKSUM() - http://msdn.microsoft.com/en-us/library/ms189788.aspx • BINARY_CHECKSUM() - http://msdn.microsoft.com/en-us/library/ms173784.aspx • Expert SQL Server Encryption - http://www.amazon.com/gp/product/1430224649? ie=UTF8&amp;tag=redgatsof- 20&amp;linkCode=as2&amp;camp=1789&amp;creative=9325&amp;creativeASIN=1430224649 • Data Hashing in SQL Server - http://blogs.msdn.com/b/sqlsecurity/archive/2011/08/26/data-hashing.aspx • CREATE ASYMMETRIC KEY - http://technet.microsoft.com/en-us/library/ms174430.aspx • ALTER ASYMMETRIC KEY - http://technet.microsoft.com/en-us/library/ms187311.aspx • CREATE CERTIFICATE - http://technet.microsoft.com/en-us/library/ms187798.aspx • ALTER CERTIFICATE - http://technet.microsoft.com/en-us/library/ms189511.aspx • BACKUP CERTIFICATE - http://technet.microsoft.com/en-us/library/ms178578.aspx • sys.certificates - http://technet.microsoft.com/en-us/library/ms189774.aspx • ENCRYPTBYPASSPHRASE - http://technet.microsoft.com/en-us/library/ms188910.aspx • ENCRYPTBYKEY - http://technet.microsoft.com/en-us/library/ms174361.aspx • ENCRYPTBYASYMKEY - http://technet.microsoft.com/en-us/library/ms186950.aspx
References • http://blogs.msdn.com/b/raulga/archive/2006/03/11/549754.aspx • Windows SDK (Makecert) - http://msdn.microsoft.com/en- us/windowsserver/bb980924.aspx • SN.EXE - http://msdn.microsoft.com/en-us/library/k5b5tt23.aspx • Subway Hacked - http://arstechnica.com/business/news/2011/12/how-hackers- gave-subway-a-30-million-lesson-in-point-of-sale-security.ars • Install SSL Certificate - http://blogs.msdn.com/b/jorgepc/archive/2008/02/19/enabling-certificates-for-ssl- connection-on-sql-server-2005-clustered-installation.aspx • Encrypting Connections to SQL Server - http://msdn.microsoft.com/en- us/library/ms189067.aspx • SQL Server 2005: A look at the master keys - part 2 - http://blogs.msdn.com/b/lcris/archive/2005/09/30/475822.aspx • Cryptography in SQL Server http://msdn.microsoft.com/en- us/library/cc837966%28v=sql.100%29.aspx • http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out- of-your-passwords/
Images • Enigma Machine - http://www.flickr.com/photos/badwsky/34164244/ • The Encryption Hierarchy from BOL - http://msdn.microsoft.com/en- US/library/ms189586%28v=SQL.90%29.aspx • Hashing Image - http://upload.wikimedia.org/wikipedia/commons/thumb/5/58/Hash_table_4_1_1_0_0_1_0_LL.svg/ 240px-Hash_table_4_1_1_0_0_1_0_LL.svg.png • TDE Structure - http://msdn.microsoft.com/en-us/library/bb934049.aspx

More Related Content

What's hot (20)

PPTX
Techdays Finland 2018 - Building secure cloud applications with Azure Key Vault
Tom Kerkhove
 
PDF
NoSQL - No Security?
Gavin Holt
 
PDF
NoSQL, no security?
wurbanski
 
PPTX
Securing Your MongoDB Deployment
MongoDB
 
PDF
NoSQL, no SQL injections?
Wayne Huang
 
PDF
Designing software with security in mind?
Omegapoint Academy
 
PDF
Elk its big log season
Eric Luellen
 
PPTX
Windows 8 Apps and the Outside World
Microsoft Developer Network (MSDN) - Belgium and Luxembourg
 
PDF
Designing software with security in mind
Omegapoint Academy
 
PPTX
Aruman Cassandra database
Umesh Dande
 
PDF
Arm yourself with Domain Driven Security. It's time to slay some security trolls
Omegapoint Academy
 
PDF
Domain Driven Security Jfokus 2016
Omegapoint Academy
 
PDF
SQL Server Column Based Encryption
David Dye
 
PDF
Getting Started with SQLite
Mindfire Solutions
 
PDF
Backup and Restore SQL Server Databases in Microsoft Azure
Datavail
 
PDF
CIS 2015- Building IAM for OpenStack- Steve Martinelli
CloudIDSummit
 
PPTX
44CON 2014 - Pentesting NoSQL DB's Using NoSQL Exploitation Framework, Franci...
44CON
 
PPTX
Geek Sync | Detecting and Responding to Database Change - Brian Kelley | IDERA
IDERA Software
 
PDF
4aa5 3404
Bloombase
 
PPT
SQL Server Encryption - Adi Cohn
sqlserver.co.il
 
Techdays Finland 2018 - Building secure cloud applications with Azure Key Vault
Tom Kerkhove
 
NoSQL - No Security?
Gavin Holt
 
NoSQL, no security?
wurbanski
 
Securing Your MongoDB Deployment
MongoDB
 
NoSQL, no SQL injections?
Wayne Huang
 
Designing software with security in mind?
Omegapoint Academy
 
Elk its big log season
Eric Luellen
 
Windows 8 Apps and the Outside World
Microsoft Developer Network (MSDN) - Belgium and Luxembourg
 
Designing software with security in mind
Omegapoint Academy
 
Aruman Cassandra database
Umesh Dande
 
Arm yourself with Domain Driven Security. It's time to slay some security trolls
Omegapoint Academy
 
Domain Driven Security Jfokus 2016
Omegapoint Academy
 
SQL Server Column Based Encryption
David Dye
 
Getting Started with SQLite
Mindfire Solutions
 
Backup and Restore SQL Server Databases in Microsoft Azure
Datavail
 
CIS 2015- Building IAM for OpenStack- Steve Martinelli
CloudIDSummit
 
44CON 2014 - Pentesting NoSQL DB's Using NoSQL Exploitation Framework, Franci...
44CON
 
Geek Sync | Detecting and Responding to Database Change - Brian Kelley | IDERA
IDERA Software
 
4aa5 3404
Bloombase
 
SQL Server Encryption - Adi Cohn
sqlserver.co.il
 

Similar to Steve Jones - Encrypting Data (20)

PDF
Programming
ssuser4978d4
 
PPTX
Protecting Your Data with Encryption
Ed Leighton-Dick
 
PDF
Sql Server 2016 Always Encrypted
Duncan Greaves PhD
 
PPT
Formal Lecture.ppt
EqinNiftalyev
 
PPTX
Understanding SQL Server 2016 Always Encrypted
Ed Leighton-Dick
 
PDF
Organizational compliance and security in Microsoft SQL 2012-2016
George Walters
 
PDF
Organizational compliance and security SQL 2012-2019 by George Walters
George Walters
 
PPTX
Column Level Encryption in Microsoft SQL Server
Behnam Mohammadi
 
PDF
columnarlevelencryption-161229175937 (2).pdf
Melvin739799
 
PPTX
Presentation
Santosh Kumar
 
PPTX
SQLCAT - Data and Admin Security
Denny Lee
 
PDF
Sql server column level encryption
muhammadhashir57
 
PPTX
SQL Server Security And Encryption
Hamid J. Fard
 
PPTX
Always encrypted overview
SolidQ
 
PDF
Enhancing the Security of Data at Rest with SAP ASE 16
SAP Technology
 
PPTX
2° Ciclo Microsoft CRUI 3° Sessione: l'evoluzione delle piattaforme tecnologi...
Jürgen Ambrosi
 
PPT
SQL Server 2008 Security Overview
ukdpe
 
PDF
Geek Sync | Always Encrypted for Beginners
IDERA Software
 
PDF
Sql Server 2008 Security Enhanments
Eduardo Castro
 
PPTX
Data encryption in database management system
Rabin BK
 
Programming
ssuser4978d4
 
Protecting Your Data with Encryption
Ed Leighton-Dick
 
Sql Server 2016 Always Encrypted
Duncan Greaves PhD
 
Formal Lecture.ppt
EqinNiftalyev
 
Understanding SQL Server 2016 Always Encrypted
Ed Leighton-Dick
 
Organizational compliance and security in Microsoft SQL 2012-2016
George Walters
 
Organizational compliance and security SQL 2012-2019 by George Walters
George Walters
 
Column Level Encryption in Microsoft SQL Server
Behnam Mohammadi
 
columnarlevelencryption-161229175937 (2).pdf
Melvin739799
 
Presentation
Santosh Kumar
 
SQLCAT - Data and Admin Security
Denny Lee
 
Sql server column level encryption
muhammadhashir57
 
SQL Server Security And Encryption
Hamid J. Fard
 
Always encrypted overview
SolidQ
 
Enhancing the Security of Data at Rest with SAP ASE 16
SAP Technology
 
2° Ciclo Microsoft CRUI 3° Sessione: l'evoluzione delle piattaforme tecnologi...
Jürgen Ambrosi
 
SQL Server 2008 Security Overview
ukdpe
 
Geek Sync | Always Encrypted for Beginners
IDERA Software
 
Sql Server 2008 Security Enhanments
Eduardo Castro
 
Data encryption in database management system
Rabin BK
 
Ad

More from Red Gate Software (20)

PDF
The future of DevOps: fully left-shifted deployments with version control and...
Red Gate Software
 
PDF
Embracing DevOps through database migrations with Flyway
Red Gate Software
 
PPTX
Database DevOps for Managed Service Providers
Red Gate Software
 
PDF
Mizuho Financial: Launching our Database DevOps journey
Red Gate Software
 
PDF
7 steps to effective SQL Server monitoring
Red Gate Software
 
PDF
Level up your deployments for SQL Source Control
Red Gate Software
 
PDF
Key findings from the 2020 state of database dev ops report
Red Gate Software
 
PPTX
Extend DevOps to Your SQL Server Databases
Red Gate Software
 
PDF
2019 year in review slides
Red Gate Software
 
PPTX
What we learned at PASS Summit in 2019
Red Gate Software
 
PPTX
Quality in Software Development: Anglia Ruskin University
Red Gate Software
 
PPTX
How SQL Change Automation helps you deliver value faster
Red Gate Software
 
PPTX
DevOps essentials from Abel Wang and Steve Jones
Red Gate Software
 
PPTX
Successfully migrating existing databases to Azure
Red Gate Software
 
PPTX
The Ultimate Guide to Choosing and Implementing the Right Monitoring Tool
Red Gate Software
 
PDF
Everything You Need to Know About the 2019 DORA Accelerate State of DevOps Re...
Red Gate Software
 
PDF
Using Redgate, AKS and Azure to bring DevOps to your database
Red Gate Software
 
PDF
Using Redgate, AKS and Azure to bring DevOps to your Database
Red Gate Software
 
PDF
How to Pitch a Software Development Initiative and Ignite Culture Change
Red Gate Software
 
PDF
Taming the Wild West
Red Gate Software
 
The future of DevOps: fully left-shifted deployments with version control and...
Red Gate Software
 
Embracing DevOps through database migrations with Flyway
Red Gate Software
 
Database DevOps for Managed Service Providers
Red Gate Software
 
Mizuho Financial: Launching our Database DevOps journey
Red Gate Software
 
7 steps to effective SQL Server monitoring
Red Gate Software
 
Level up your deployments for SQL Source Control
Red Gate Software
 
Key findings from the 2020 state of database dev ops report
Red Gate Software
 
Extend DevOps to Your SQL Server Databases
Red Gate Software
 
2019 year in review slides
Red Gate Software
 
What we learned at PASS Summit in 2019
Red Gate Software
 
Quality in Software Development: Anglia Ruskin University
Red Gate Software
 
How SQL Change Automation helps you deliver value faster
Red Gate Software
 
DevOps essentials from Abel Wang and Steve Jones
Red Gate Software
 
Successfully migrating existing databases to Azure
Red Gate Software
 
The Ultimate Guide to Choosing and Implementing the Right Monitoring Tool
Red Gate Software
 
Everything You Need to Know About the 2019 DORA Accelerate State of DevOps Re...
Red Gate Software
 
Using Redgate, AKS and Azure to bring DevOps to your database
Red Gate Software
 
Using Redgate, AKS and Azure to bring DevOps to your Database
Red Gate Software
 
How to Pitch a Software Development Initiative and Ignite Culture Change
Red Gate Software
 
Taming the Wild West
Red Gate Software
 
Ad

Recently uploaded (20)

PPTX
AI Penetration Testing Essentials: A Cybersecurity Guide for 2025
defencerabbit Team
 
PPTX
Digital Circuits, important subject in CS
contactparinay1
 
PDF
Future-Proof or Fall Behind? 10 Tech Trends You Can’t Afford to Ignore in 2025
DIGITALCONFEX
 
PPTX
MuleSoft MCP Support (Model Context Protocol) and Use Case Demo
shyamraj55
 
PDF
POV_ Why Enterprises Need to Find Value in ZERO.pdf
darshakparmar
 
PDF
Reverse Engineering of Security Products: Developing an Advanced Microsoft De...
nwbxhhcyjv
 
PPTX
The Project Compass - GDG on Campus MSIT
dscmsitkol
 
PDF
Staying Human in a Machine- Accelerated World
Catalin Jora
 
DOCX
Cryptography Quiz: test your knowledge of this important security concept.
Rajni Bhardwaj Grover
 
PDF
NLJUG Speaker academy 2025 - first session
Bert Jan Schrijver
 
PPTX
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
PDF
Transforming Utility Networks: Large-scale Data Migrations with FME
Safe Software
 
PPTX
Mastering ODC + Okta Configuration - Chennai OSUG
HathiMaryA
 
PPTX
From Sci-Fi to Reality: Exploring AI Evolution
Svetlana Meissner
 
PDF
Transcript: Book industry state of the nation 2025 - Tech Forum 2025
BookNet Canada
 
PDF
“Voice Interfaces on a Budget: Building Real-time Speech Recognition on Low-c...
Edge AI and Vision Alliance
 
PDF
What’s my job again? Slides from Mark Simos talk at 2025 Tampa BSides
Mark Simos
 
PDF
LOOPS in C Programming Language - Technology
RishabhDwivedi43
 
PDF
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 
PDF
NASA A Researcher’s Guide to International Space Station : Physical Sciences ...
Dr. PANKAJ DHUSSA
 
AI Penetration Testing Essentials: A Cybersecurity Guide for 2025
defencerabbit Team
 
Digital Circuits, important subject in CS
contactparinay1
 
Future-Proof or Fall Behind? 10 Tech Trends You Can’t Afford to Ignore in 2025
DIGITALCONFEX
 
MuleSoft MCP Support (Model Context Protocol) and Use Case Demo
shyamraj55
 
POV_ Why Enterprises Need to Find Value in ZERO.pdf
darshakparmar
 
Reverse Engineering of Security Products: Developing an Advanced Microsoft De...
nwbxhhcyjv
 
The Project Compass - GDG on Campus MSIT
dscmsitkol
 
Staying Human in a Machine- Accelerated World
Catalin Jora
 
Cryptography Quiz: test your knowledge of this important security concept.
Rajni Bhardwaj Grover
 
NLJUG Speaker academy 2025 - first session
Bert Jan Schrijver
 
New ThousandEyes Product Innovations: Cisco Live June 2025
ThousandEyes
 
Transforming Utility Networks: Large-scale Data Migrations with FME
Safe Software
 
Mastering ODC + Okta Configuration - Chennai OSUG
HathiMaryA
 
From Sci-Fi to Reality: Exploring AI Evolution
Svetlana Meissner
 
Transcript: Book industry state of the nation 2025 - Tech Forum 2025
BookNet Canada
 
“Voice Interfaces on a Budget: Building Real-time Speech Recognition on Low-c...
Edge AI and Vision Alliance
 
What’s my job again? Slides from Mark Simos talk at 2025 Tampa BSides
Mark Simos
 
LOOPS in C Programming Language - Technology
RishabhDwivedi43
 
Newgen Beyond Frankenstein_Build vs Buy_Digital_version.pdf
darshakparmar
 
NASA A Researcher’s Guide to International Space Station : Physical Sciences ...
Dr. PANKAJ DHUSSA
 

Steve Jones - Encrypting Data

  • 1. Encrypting Data in SQL Server Steve Jones Editor in Chief SQLServerCentral, Red Gate Software #sqlinthecity
  • 2. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 3. • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys Agenda
  • 5. encryption is the process of transforming information (referred to as plaintext) using an algorithm (called a cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information (in cryptography, referred to as ciphertext). - Wikipedia
  • 9. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 10. Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server memory SQL Server data files Backup files
  • 11. Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SQL Server memory
  • 12. Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SL Server memory SQL Server memory
  • 13. Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server memory SQL Server data files Backup files
  • 14. Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SQL Server memory
  • 15. Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server data files Backup files SQL Server memory
  • 16. Encryption in SQL Server Client SQL Server Instance Client file system Communication Link (the wire) SQL Server memory SQL Server data files Backup files
  • 18. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 19. Communications • Encrypt the connection to/from SQL Server – Encrypt “the wire” • Two options – SSL encryption from SQL Server – IPSec encryption at the Windows host network layer.
  • 20. SSL Communications • Install certificate on SQL Server, set the FORCE ENCRYPTION options – Yes = required – No = client option • Certificate must be valid based on the system time • DO NOT USE SELF SIGNED CERTIFICATES • All rules in BOL – Encrypting Connections to SQL Server – How to: Enable Encrypted Connections to the Database Engine
  • 21. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 22. Transparent Data Encryption • TDE introduced in SQL Server 2008 • Protects the data at rest by encrypting the data on disk. – The transaction log is encrypted – Backups are encrypted (can eliminate compression) – Tempdb is encrypted for all operations. – Replication data is not encrypted – Filestream data is not encrypted
  • 23. Transparent Data Encryption • Implemented with a simple ALTER DATABASE command ALTER DATABASE AdventureWorks2008R2 SET ENCRYPTION ON; GO • Encryption is handled by the Database Encryption Key (DEK) • Requires a Database Master Key (DMK) and a Certificate to protect the DEK • Backups of the certificate protecting the DEK are necessary to restore a backup.
  • 26. Transparent Data Encryption • Overhead is < 5% • Enterprise Edition only (not BI edition) • Value? • Third Party Tools
  • 27. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 28. Hashing • “A hash function is any algorithm or subroutine that maps large data sets, called keys, to smaller data sets.” - Wikipedia
  • 29. Hashing • SQL Server uses the HASHBYTES functions • CHECKSUM() or BINARY_CHECKSUM() can also be used. • other implementations using .NET/CLR are better. (see Expert SQL Server Encryption, Michael Coles) • SQL Server 2012 adds SHA2_256 and SHA2_512 algorithms.
  • 31. Hashing orEncryption • Hashing is not really encryption – Decryption is not supported (usually) • Hashing is deterministic, encryption is not • Hashing is quicker • In general, a hash of searchable data can be used to allow indexing of encrypted data. – Caveat – Only hash the portion of the encrypted data needed for searching, e.g. last four digits of a credit card number. • Choose the strongest algorithm available in your version. – SQL Server 2008 – SHA1 – SQL Server 2012 - SHA2_512
  • 32. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 33. Keys • Multiple Keys in SQL Server – Service Master Key – Database Master Key – Database Encryption Key – Symmetric Keys – Asymmetric Keys – Certificates
  • 35. Service MasterKey • Service Master Key = SMK • The Service Master Key is created when it is first needed. No CREATE DDL • Secured by Windows DPAPI (default) • Accessed by Service Account for database engine, or a principal with access to the service account name and password
  • 36. Service MasterKey • Must be manually backed up. BACKUP SERVICE MASTER KEY • Must be restored in a DR situation to open other keys secured by this key (Database Master Keys) • Can be regenerated if necessary. – This can cause data loss • Encryption is now AES
  • 37. Database MasterKey • Database Master Key = DMK • The Database Master Key is created by an administrator (CREATE/ALTER DDL) • This is secured by the SMK and a password (TripleDES encryption in 2008, AES in 2012) • This can be secured by password only (DROP ENCRYPTION BY SERVICE MASTER KEY option)
  • 38. Database MasterKey • Backup and restore using DDL commands BACKUP MASTER KEY RESTORE MASTER KEY • OPEN/CLOSE manually if not protected by the SMK • Attach/restore of an encrypted database requires the password for the DMK • You can alter the DMK to add SMK encryption after attach/restore
  • 39. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 40. Symmetric Encryption • Like a normal key lock • The key that encrypts the data also decrypts the data
  • 41. Symmetric Keys • Symmetric Keys are created in a database and are always in that database (cannot be backed up/restored) • Symmetric Keys are deterministic, and can be duplicated with the same creation parameters. • Symmetric keys require less resources than asymmetric keys, but there is still an additional CPU load from their use.
  • 42. Symmetric Keys • The identity value always generates the same GUID for the key. These must be unique in a session. • The KEY_SOURCE and IDENTITY can be used to recreate a key. If you choose the same ones, and the same algorithm, you’ll get the same key • You can, and should, secure these keys with asymmetric keys
  • 44. Symmetric Keys • The algorithm used is stored in the header of the encrypted data. • You can generate temporary keys for encryption/decryption • CREATE SYMMETRIC KEY #MyTempKey • Encryption with passphrases uses symmetric keys (TripleDES)
  • 45. Agenda • What is encryption? • Encryption in SQL Server • Communications • Transparent Data Encryption • Hashing • Keys • Symmetric Keys • Asymmetric Keys
  • 46. Asymmetric Encryption • Asymmetric keys are unlike keys and locks in the real world. • Based on factoring very large prime numbers. • More secure than symmetric keys • Require more resources for encryption/decryption than symmetric keys
  • 47. Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Key 1 0x26CD66B61E50369C BBDB42F484237370E0 2238EEAE588E06D00F 8D0C6FAB5C48F68639 ABB4003564CFB48A4 1BA373CFA411E99D3 AB31A1B7CE40CB35 0x26CD66B61E50369C BBDB42F484237370E0 2238EEAE588E06D00F 8D0C6FAB5C48F68639 ABB4003564CFB48A4 1BA373CFA411E99D3 AB31A1B7CE40CB35 Asymmetric Algorithm Key 1 0xE7A518047A8D3836B 76006D9CE04DA2F803 607A57CD7F9EE855FC 3451EB02A076F28DD6 14BA841AC756E52CFE C4006746480C8204D57 9083C4AD0D627CAD24
  • 48. Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Key 1 0x26CD66B61E5036 9CBBDB42F4842373 70E02238EEAE588E 06D00F8D0C6FAB5 C48F68639ABB4003 564CFB48A41BA37 3CFA411E99D3AB3 1A1B7CE40CB35 0x26CD66B61E5036 9CBBDB42F4842373 70E02238EEAE588E 06D00F8D0C6FAB5 C48F68639ABB4003 564CFB48A41BA37 3CFA411E99D3AB3 1A1B7CE40CB35 Asymmetric Algorithm Key 2 Now is the time for all good men to come to the aid of their country
  • 49. Asymmetric Encryption Key 1 – Private Key Key 2 – Public Key Keys 1 and 2 are paired and generated together. One is referred to as a private key and the other a public key. Only the user has the private key, but the public key is distributed to everyone
  • 50. Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Anyone encrypts with Steve’s Public Key 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 Asymmetric Algorithm Only Steve can decrypt with his private key Now is the time for all good men to come to the aid of their country
  • 51. Asymmetric Encryption Now is the time for all good men to come to the aid of their country Asymmetric Algorithm Steve can encrypt with his private key 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 0x26CD66B61E50369 CBBDB42F484237370 E02238EEAE588E06D 00F8D0C6FAB5C48F6 8639ABB4003564CFB 48A41BA373CFA411E 99D3AB31A1B7CE40 CB35 Asymmetric Algorithm Anyone can decrypt with Steve’s public key Now is the time for all good men to come to the aid of their country
  • 52. Asymmetric Encryption Now is the time Steve can encrypt with his private key 0x26CD66B61E50369C BBDB42F48423737 Steve encrypts again with Andy’s Public Key 0x48385D8A87BD329FF 328E476BC234 0x26CD66B61E50369C BBDB42F48423737
  • 53. Asymmetric Encryption 0x48385D8A87B D329FF328E476 BC234 Andy decrypts the outer message with his private key 0x26CD66B61E50369C BBDB42F48423737 Andy then decrypts with Steve’s Public key to verify the message is from Steve Now is the time0x26CD66B61E50369C BBDB42F48423737
  • 54. Asymmetric Encryption • Use DDL to create asymmetric keys (CREATE/DROP/ALTER) • Can be created outside the server (FROM FILE option) – SN.exe (Visual Studio SDK) – Makecert (Windows SDK)
  • 55. Asymmetric Encryption • You can encrypt an asymmetric key with a password. – This will be required for decryption – Not required for encryption • Asymmetric keys are usually used to encrypt symmetric keys, which encrypt the data. This balances security with resources • You can remove the private key (prevents decryption in that db).
  • 56. Certificates • Certificates are asymmetric keys with additional metadata. • Expiration dates are not enforced by SQL Server – Administrators must decrypt/re-encrypt the data and remove the old certificates – Useful for marking the key rotation dates (query sys.certificates) • To restore certificates, use CREATE CERTIFICATE. • SQL Server 2012 increases the maximum certificate length to 4,096. • Always use the longest length you can.
  • 58. Key Length • Use long keys • Use strong algorithms (MD5/SHA1 = bad) • DKIM attack on Google’s mail system* – 384 bit key cracked on high end laptop – 512 bit key cracked for ~$75 using AWS – 768 bit key could be cracked by large orgs – This changes all the time www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/all/ 58
  • 59. The End • Questions? • Don’t forget to fill out your feedback forms • Resources at the end of the PPT • www.sqlservercentral.com/forums • www.voiceofthedba.com/talks
  • 60. References • Encryption - http://en.wikipedia.org/wiki/Encryption • Understanding TDE - http://msdn.microsoft.com/en-us/library/bb934049.aspx • Hash Function - http://en.wikipedia.org/wiki/Hash_function • Rainbow Tables - http://en.wikipedia.org/wiki/Rainbow_table • Transparent Data Encryption – https://www.simple-talk.com/sql/database-administration/transparent-data-encryption/ • How to enable/remove Transparent Data Encryption (TDE) - http://blogs.msdn.com/b/batuhanyildiz/archive/2012/10/16/how-to-enable-remove-transparent-data-encryption-tde. • Sys.database_encryption_keys - http://msdn.microsoft.com/en-us/library/bb677274.aspx • TDE and Backup Compression - http://sqlcat.com/sqlcat/b/technicalnotes/archive/2009/02/16/tuning-backup-compression-part-2.aspx • Encrypting Connections to SQL Server - http://msdn.microsoft.com/en-us/library/ms189067.aspx • ENCRYPTBYCERT - http://technet.microsoft.com/en-us/library/ms188061.aspx • DECRYPTBYKEY - http://technet.microsoft.com/en-us/library/ms181860.aspx • DECRYPTBYASYMKEY - http://technet.microsoft.com/en-us/library/ms189507.aspx • DECRYPTBYCERT - http://technet.microsoft.com/en-us/library/ms178601.aspx • DECRYPTBYKEYAUTOASYMKEY - http://technet.microsoft.com/en-us/library/ms365420.aspx • DECRYPTBYKEYAUTOCERT - http://technet.microsoft.com/en-us/library/ms182559.aspx
  • 61. References • HASHBYTES - http://msdn.microsoft.com/en-us/library/ms174415.aspx • CHECKSUM() - http://msdn.microsoft.com/en-us/library/ms189788.aspx • BINARY_CHECKSUM() - http://msdn.microsoft.com/en-us/library/ms173784.aspx • Expert SQL Server Encryption - http://www.amazon.com/gp/product/1430224649? ie=UTF8&amp;tag=redgatsof- 20&amp;linkCode=as2&amp;camp=1789&amp;creative=9325&amp;creativeASIN=1430224649 • Data Hashing in SQL Server - http://blogs.msdn.com/b/sqlsecurity/archive/2011/08/26/data-hashing.aspx • CREATE ASYMMETRIC KEY - http://technet.microsoft.com/en-us/library/ms174430.aspx • ALTER ASYMMETRIC KEY - http://technet.microsoft.com/en-us/library/ms187311.aspx • CREATE CERTIFICATE - http://technet.microsoft.com/en-us/library/ms187798.aspx • ALTER CERTIFICATE - http://technet.microsoft.com/en-us/library/ms189511.aspx • BACKUP CERTIFICATE - http://technet.microsoft.com/en-us/library/ms178578.aspx • sys.certificates - http://technet.microsoft.com/en-us/library/ms189774.aspx • ENCRYPTBYPASSPHRASE - http://technet.microsoft.com/en-us/library/ms188910.aspx • ENCRYPTBYKEY - http://technet.microsoft.com/en-us/library/ms174361.aspx • ENCRYPTBYASYMKEY - http://technet.microsoft.com/en-us/library/ms186950.aspx
  • 62. References • http://blogs.msdn.com/b/raulga/archive/2006/03/11/549754.aspx • Windows SDK (Makecert) - http://msdn.microsoft.com/en- us/windowsserver/bb980924.aspx • SN.EXE - http://msdn.microsoft.com/en-us/library/k5b5tt23.aspx • Subway Hacked - http://arstechnica.com/business/news/2011/12/how-hackers- gave-subway-a-30-million-lesson-in-point-of-sale-security.ars • Install SSL Certificate - http://blogs.msdn.com/b/jorgepc/archive/2008/02/19/enabling-certificates-for-ssl- connection-on-sql-server-2005-clustered-installation.aspx • Encrypting Connections to SQL Server - http://msdn.microsoft.com/en- us/library/ms189067.aspx • SQL Server 2005: A look at the master keys - part 2 - http://blogs.msdn.com/b/lcris/archive/2005/09/30/475822.aspx • Cryptography in SQL Server http://msdn.microsoft.com/en- us/library/cc837966%28v=sql.100%29.aspx • http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out- of-your-passwords/
  • 63. Images • Enigma Machine - http://www.flickr.com/photos/badwsky/34164244/ • The Encryption Hierarchy from BOL - http://msdn.microsoft.com/en- US/library/ms189586%28v=SQL.90%29.aspx • Hashing Image - http://upload.wikimedia.org/wikipedia/commons/thumb/5/58/Hash_table_4_1_1_0_0_1_0_LL.svg/ 240px-Hash_table_4_1_1_0_0_1_0_LL.svg.png • TDE Structure - http://msdn.microsoft.com/en-us/library/bb934049.aspx

Editor's Notes

  • #5: What is encryption? The image is the Enigma Machine from WWII.
  • #6: From Wikipedia
  • #7: A simple cipher, known as a substitution or rotation cipher. In this case, this is a ROT4. The bottom line is an encrypted string. The top line is the plain text line, and the second line is used to encrypt or decrypt the data.
  • #8: And the decryption
  • #9: Here is a more complex encryption using a symmetric key in T-SQL.
  • #11: Here is the essential link between a client and server. The client has a computer, with a file system and connect to the SQL Server instance across some communication link (the wire). The data in SQL Server is available in its memory (for querying, manipulating, etc.). The data gets stored on disk drives in the data files, and then is copied to backup files, either on disk or tape.
  • #12: We can’t do much about the client file system. If clients copy/paste data into a text file, spreadsheet, etc., we lose control. Even if they take an image of the screen, they can store data unprotected on their local file system
  • #13: We can’t do a lot to encrypt things on the client as that’s where we really need data decrypted so the client can read it.
  • #14: We can encrypt the wire, using SSL communication in SQL Server, or some higher level tunneling like IPSec.
  • #15: We can encrypt data in SQL Server’s memory. Not completely, but we can use one of our encryption methods to ensure that queries require keys to return the plaintext.
  • #16: If we use keys, we also have encryption of the data on the data files, or we have the option of using Transparent Data Encryption
  • #17: As with the data files, we can encrypt the backup files as well.
  • #26: Create unencrypted db. Detach. View with hex editor. Encrypt, detach, view.