Hot answers tagged

10

The attacker will get the data unencrypted. The T in TDE stands for "transparent". The user will never see encrypted data. The database transparently decrypts it when it is read from disk and transparently encrypts it when writing to disk. If your application is insecure, TDE doesn't help you plug those application security holes. You need to fix those ...


10

We have recently implemented TDE along with AlwaysON in Production running SQL Server 2014. In our application, we noticed a slight (1-3%) increase in CPU utilization. Your environment is different, so do a thorough load testing with some realistic PROD datasize. Takeaways from embracing TDE : Backup compression and TDE does not go hand in hand i.e. You ...


8

As in the other answer: you need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404: Cumulative Update 8 for SQL Server 2014 Cumulative Update 1 for SQL Server 2014 SP1 Cumulative Update 6 for SQL Server 2012 SP2 Cumulative Update 7 for SQL Server 2014 After enabling only TLS 1.2 you will possibly encounter two errors: SQL ...


4

Whether encrypted RDs is disk/file level encrypted or db level encrypted? I have done some searching, but could bot able to get a clear answer. The encryption is done at the file/disk level. From this page, emphasis mine: Amazon RDS encrypted instances provide an additional layer of data protection by securing your data from unauthorized access to the ...


3

To find items associated with Certificates and Asymmetric Keys, first try the query posted in this DBA.SE Answer: Find signed procedures, functions, triggers, assemblies and by which certificates / asymmetric keys If that does not return any objects, next try the following queries which look for: Logins Users Service Broker Endpoints Database Mirroring ...


3

This is what Always Encrypted was created for, but you'll have to wait for SQL Server 2016 (and for the jTDS drivers to catch up). In the meantime, your Java app could call stored procedures, such that the data is encrypted there. That's really not going to change the fact that the decrypted text is being sent over the wire, but it does mean you can ...


3

All versions prior to 2016 (currently in CTP/beta) doesn't allow you to easily lock DBAs from the data. Column encryption that you employed stores the key in the DB and secures it using the key hierarchy within the database which roots itself in the service master key. That means you can't lock it away from DBAs. The only way out is to use extensible key ...


3

As far as my testing goes (using SQL Server Express 2014, SP1 and SQL Server Developer 2012 SP2, both 64-it), the formula when not using an authenticator for the return value (VARBINARY) length of: ENCRYPTBYPASSPHRASE('_My_PassPhr@zE_yo_', {anything}) is: 28 + (8 * (DATALENGTH(@ClearText) / 8)) Try the following: DECLARE @ClearText VARCHAR(8000); SET @...


3

If you want to restore on a different server, you should be able to do so with the certificate, private key and database backup file(s). When a certificate is created in any database in SQL Server, it is part of an encryption hierarchy. The certificate itself only contains a public key, which needs no protection, however, the database will also contain a ...


2

From TechNet sys.dm_exec_connections DMV: the encrypt_option will display FALSE if the connection is not encrypted.


2

There are many encryption methods available in mySQL. If you need two way encryption you could use aes_encrypt which has the accompanying aes_decrypt If if you only need a secure hash then you could use sha2 The following statement could get you a similar result to openssl_random_pseudo_bytes SELECT HEX(SHA2(CONCAT(NOW(), RAND(), UUID()), 512)); The ...


2

Note that encryption of modules in SQL Server is not really encryption; it is more like weak obfuscation. Anyone with a search engine and a few minutes to kill can reverse engineer your objects, so encrypting them is almost completely pointless. DENY VIEW DEFINITION is far more effective here (as well as not giving your developers sysadmin and other ...


2

All permissions are stored in sys.database_permissions. Search for the relevant class (24 == Symmetric Key or 26 = Asymmetric Key) and major_id (your key id). That being said, is always tricky to answer 'what permissions are effective on a object?' because of group database membership and Windows group membership. For the current account you you can use sys....


2

Without going into a long discussion about certificates and keys, I'm just going to give you what you need to create some keys, grant some access to them and then review the access granted. I've included certificates because your keys depend upon them if you chose ENCRYPTION BY CERTIFICATE. USE SOME_DATABASE; GO -- assuming you have a login testuser ...


2

Since your thumbprint is being returned as a System.String you actually cannot easily convert it to a System.Byte. I have not gotten a full example that you are doing to work completely but will show you how I convert the thumbprint, and it seems to work: $encode = [System.Text.Encoding]::UTF8 $r1 = $encode.GetBytes($thumbprint) $sha = New-Object System....


2

This setting will only let you 'respect' the encrypted database setting. It will not generate scripts for you to run to enable encryption on the target deployment server. If you uncheck that, it will then disable encryption on your source database scripts that you are generating for the DACPAC. Since TDE requires several keys to fully function, you might ...


1

This is definitely possible with your version of SQL Server. You can create stored procedures to manage the encryption and decryption on the server or you can rename the original table and create a view with the original table name and with instead of triggers for the insert and update operations. Delete works without adding a trigger. You will need to ...


1

If I'm not mistaken, the fingerprint is a hexadecimal number. That means you could store it as a binary number, since two hexadecimal characters can be represented by a single byte, making a 32-character hexadecimal string = 16 bytes. Here's the documentation on binary and varbinary data types for MySQL 5.7 (I don't have a test environment handy). I do ...


1

If you have SQL Server Standard edition then you do not have Encryption built into the product. You have other options as the articles you reference mention, but they require work on your part to implement. I think the confusion is where you are seeing that you can implement column/cell encryption using Enterprise edition OR through alternative methods. ...


1

(OK, this is not an answer. Rather it is a warning that the question reflects a need for far more research.) Lock your doors, but don't bother to lock your windows. If you have a laptop with Social Security Number on it and it gets stolen, it won't matter if the data is super-duper-encrypted -- the decryption key is sitting somewhere in the laptop! You ...


1

With security in SQL Server, one needs to be very watchful that permissions are not indirectly granted when not intended. Designing granular permissions for the SQL Server system must be a very meticulous task for Microsoft. Once created, the certificate can be altered, but only to drop the private key. View definition lets the user see the metadata, however ...


1

This is not scientific; the only way to get the scientific answer would be to look at the code the SQL Server developers used to implement the 3DES 128 algorithm. Having said that, built a quick test rig that attempts to determine the practical length of the encrypted text. ;WITH Num1 AS ( SELECT TOP(4000) rn = ROW_NUMBER() OVER (ORDER BY o.object_id, o1....


1

There are various methods to check the connections : You can use a third party tool like Wireshack which lets you see what's happening on your network at a microscopic level and will help you in getting those encrypted connections. You can also use the Microsoft Network Monitor 3.4 to get those connection details. And as mentioned by travis you can also ...


1

The short answer is "yes" but I'm not sure that is what you are referring to in the question. You always have an encryption key in SSRS to encrypt/decrypt the sensitive information. You are not required to backup or restore that encryption key if you don't care that your sensitive information (passwords, connection strings etc) will be lost if you have to ...


1

As of January 29th, Microsoft SQL Server supports TLS 1.2 for SQL Server 2008, SQL Server 2008 R2, SQL Server 2012 and SQL Server 2014 and major client drivers like Server Native Client, Microsoft ODBC Driver for SQL Server, Microsoft JDBC Driver for SQL Server and ADO.NET (SqlClient). Blog post about the release: http://blogs.msdn.com/b/sqlreleaseservices/...


1

Tom Li- MSFT described a solution to what sounds like your problem, but his solution was for SQL Server 2008. (But just how much has the installer been improved since then?) https://social.msdn.microsoft.com/forums/sqlserver/en-US/f009e660-503a-4569-a92d-9cc2ef790ca3/install-failure-certificate-chain-trust Key points from his post include: This ...


1

You have several options: If you want to encrypt the files containing the database you have dm-crypt included in the kernel to provide that kind of security https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt If your app its outside the database machine also you want to encrypt the communication, you can use the ssl option that its already included in ...


1

If you have MYSQL installed and running on a Windows Server, you may want to look into BitLocker with TPM encryption plus PIN boot password. Even if the host OS is Windows but the CentOS is a VM, then this would suffice. TrueCrypt VeraCrypt There's data-at-rest encryption so when it's at rest on a server disk partition not being accessed by some query, ...


1

ALTER DATABASE ENCRYPTION KEY Requires CONTROL permission on the database and VIEW DEFINITION permission on the certificate or asymmetric key that is used to encrypt the database encryption key. You must also add view definition according to MSDN. https://msdn.microsoft.com/en-us/library/bb630389%28v=sql.110%29.aspx


1

Don't confuse Oracle Advanced Security with encrypted SSL client connections to the database. The Advanced Security option is comprised of two main features, Data Radaction and Transparent Data Encryption. TDE is the encryption of data within tables, so that if someone captures the datafiles they won't be able to read table data in the clear inside the ...



Only top voted, non community-wiki answers of a minimum length are eligible