Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I'm moving an App to Azure and need to achieve PCI compliance for a couple columns in a single table. I realize I can encrypt the data before I store it, but I was wondering if there was a feature in SQL Azure that can manage part of this for me. I've done some reading but I'm not sure what is; or is not; supported in SQL Azure.

I've read about patterns using SQL Server (and not SQL Azure) where data encryption & decryption was applied behind a View. In that case, all clients accessed data via a View and consequently were abstracted from the Encryption/Descryption process. With that said, it seems a bit dangerous.

I'm open to any and all suggestions on how to deal with this situation.

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

Short answer: as of April 20, 2012 column encryption is not supported in SQL Azure, see: http://msdn.microsoft.com/en-us/library/windowsazure/ee336253.aspx and search for ENCRYPT. You will see that all of the encryption functions are listed as unsupported.

If you need to encrypt your data at rest and have to support SQL Azure then you are going to have to do your encryption at the application level. This is more difficult to get right as lots of the good encryption practices (using nonces as initialization vectors for each cell, key management for tracking which keys encrypt which columns, integrity verification, layered protection of encryption keys with role based permissions) you will have to implement yourself. I strongly recommend getting a security professional to work with you on the encryption as it is challenging to get right and if you miss something then you have a false sense of security that could really burn you later.

You could look at http://securentity.codeplex.com, which claims to be a solution for managing encrypted data and supports SQL Azure. I have not personally used it, nor can I vouch for it's correctness, but it is a potential option.

Other information:

In SQL Server column level encryption is easy and very secure (even with a view) because you can use roles to manage who can access the encryption keys. Even if a user can select from a view, if they are not granted access to the key that encrypts the underlying data then they will get back NULLs for those encrypted columns. I have a set of sample code for SQL Server 2005 and higher that demonstrates the encryption capabilities of SQL Server here: http://sqlcrypto.codeplex.com

share|improve this answer
add comment

Windows Azure is Level 1 compliant under the Payment Card Industry (PCI) Data Security Standards (DSS) as verified by an independent Qualified Security Assessor (QSA), allowing merchants to establish a secure cardholder environment and to achieve their own certification.

https://www.windowsazure.com/en-us/support/trust-center/compliance/

To encrypt a SQL table hosted in Azure, the easiest route is to simply spin up a SQL IaaS instance, and enable TDE or column level encryption. (Rather than use the SQL Azure PaaS product, which doesn't support transparent data encryption or cell level encryption).

There are a lot of other security requirements to consider in addition to encrypting credit card numbers though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.