Hot answers tagged

9

The attacker will get the data unencrypted. The T in TDE stands for "transparent". The user will never see encrypted data. The database transparently decrypts it when it is read from disk and transparently encrypts it when writing to disk. If your application is insecure, TDE doesn't help you plug those application security holes. You need to fix those ...


8

As in the other answer: you need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404: Cumulative Update 8 for SQL Server 2014 Cumulative Update 1 for SQL Server 2014 SP1 Cumulative Update 6 for SQL Server 2012 SP2 Cumulative Update 7 for SQL Server 2014 After enabling only TLS 1.2 you will possibly encounter two errors: SQL ...


4

Whether encrypted RDs is disk/file level encrypted or db level encrypted? I have done some searching, but could bot able to get a clear answer. The encryption is done at the file/disk level. From this page, emphasis mine: Amazon RDS encrypted instances provide an additional layer of data protection by securing your data from unauthorized access to ...


3

All versions prior to 2016 (currently in CTP/beta) doesn't allow you to easily lock DBAs from the data. Column encryption that you employed stores the key in the DB and secures it using the key hierarchy within the database which roots itself in the service master key. That means you can't lock it away from DBAs. The only way out is to use extensible key ...


3

As far as my testing goes (using SQL Server Express 2014, SP1 and SQL Server Developer 2012 SP2, both 64-it), the formula when not using an authenticator for the return value (VARBINARY) length of: ENCRYPTBYPASSPHRASE('_My_PassPhr@zE_yo_', {anything}) is: 28 + (8 * (DATALENGTH(@ClearText) / 8)) Try the following: DECLARE @ClearText VARCHAR(8000); SET ...


3

Yes, stay away from the sp_OA* OLE Automation procedures. If you want / need to handle this purely within SQL Server then you can do so using SQLCLR, which replaces the sp_OA* OLE Automation procedures. And if you aren't using xp_cmdshell for anything else, then no need to enable it just for this (although to be fair, if using SQL Agent, then a CMD step ...


3

Well we have quite a mixed servers,using encryption, depending upon the need of business. For very critical we decided to upgrade to enterprise as it not only provides TDE but other benefits as well when it comes to performance or troubleshooting. Yes, TDE is quite effective and very good, but since it comes with a cost we decided for medium and low ...


3

Even if you configured RBS to use FILESTREAM, TDE does not apply to FILESTREAM: Transparent Data Encryption and FILESTREAM DATA FILESTREAM data is not encrypted even when TDE is enabled.


3

The files are stored in a blob in the sharepoint database and as TDE encrypts all the pages in the database all the files will be encrypted there within. It's important to notice that while the database is mounted on the server the database server will serve the files unencrypted to the Sharepoint application server and it's clients. The Sharepoint ...


3

This is what Always Encrypted was created for, but you'll have to wait for SQL Server 2016 (and for the jTDS drivers to catch up). In the meantime, your Java app could call stored procedures, such that the data is encrypted there. That's really not going to change the fact that the decrypted text is being sent over the wire, but it does mean you can ...


2

I have dealt a lot with PCI and HIPAA recently since we've developed the ApexSQL Audit compliance tool (some details about the tool can be found here), and during a few years of working on the tool and demoing the tool, I was engaged in numerous discussions about the status of DBA in relation to compliance rules. PCI and HIPAA are not developed to deal with ...


2

There are many encryption methods available in mySQL. If you need two way encryption you could use aes_encrypt which has the accompanying aes_decrypt If if you only need a secure hash then you could use sha2 The following statement could get you a similar result to openssl_random_pseudo_bytes SELECT HEX(SHA2(CONCAT(NOW(), RAND()), 512)); The statement ...


2

Note that encryption of modules in SQL Server is not really encryption; it is more like weak obfuscation. Anyone with a search engine and a few minutes to kill can reverse engineer your objects, so encrypting them is almost completely pointless. DENY VIEW DEFINITION is far more effective here (as well as not giving your developers sysadmin and other ...


2

All permissions are stored in sys.database_permissions. Search for the relevant class (24 == Symmetric Key or 26 = Asymmetric Key) and major_id (your key id). That being said, is always tricky to answer 'what permissions are effective on a object?' because of group database membership and Windows group membership. For the current account you you can use ...


2

Without going into a long discussion about certificates and keys, I'm just going to give you what you need to create some keys, grant some access to them and then review the access granted. I've included certificates because your keys depend upon them if you chose ENCRYPTION BY CERTIFICATE. USE SOME_DATABASE; GO -- assuming you have a login testuser ...


2

Since your thumbprint is being returned as a System.String you actually cannot easily convert it to a System.Byte. I have not gotten a full example that you are doing to work completely but will show you how I convert the thumbprint, and it seems to work: $encode = [System.Text.Encoding]::UTF8 $r1 = $encode.GetBytes($thumbprint) $sha = New-Object ...


2

This setting will only let you 'respect' the encrypted database setting. It will not generate scripts for you to run to enable encryption on the target deployment server. If you uncheck that, it will then disable encryption on your source database scripts that you are generating for the DACPAC. Since TDE requires several keys to fully function, you might ...


2

From TechNet sys.dm_exec_connections DMV: the encrypt_option will display FALSE if the connection is not encrypted.


1

The short answer is "yes" but I'm not sure that is what you are referring to in the question. You always have an encryption key in SSRS to encrypt/decrypt the sensitive information. You are not required to backup or restore that encryption key if you don't care that your sensitive information (passwords, connection strings etc) will be lost if you have to ...


1

If I'm not mistaken, the fingerprint is a hexadecimal number. That means you could store it as a binary number, since two hexadecimal characters can be represented by a single byte, making a 32-character hexadecimal string = 16 bytes. Here's the documentation on binary and varbinary data types for MySQL 5.7 (I don't have a test environment handy). I do ...


1

If you have SQL Server Standard edition then you do not have Encryption built into the product. You have other options as the articles you reference mention, but they require work on your part to implement. I think the confusion is where you are seeing that you can implement column/cell encryption using Enterprise edition OR through alternative methods. ...


1

(OK, this is not an answer. Rather it is a warning that the question reflects a need for far more research.) Lock your doors, but don't bother to lock your windows. If you have a laptop with Social Security Number on it and it gets stolen, it won't matter if the data is super-duper-encrypted -- the decryption key is sitting somewhere in the laptop! You ...


1

This is not scientific; the only way to get the scientific answer would be to look at the code the SQL Server developers used to implement the 3DES 128 algorithm. Having said that, built a quick test rig that attempts to determine the practical length of the encrypted text. ;WITH Num1 AS ( SELECT TOP(4000) rn = ROW_NUMBER() OVER (ORDER BY o.object_id, ...


1

There are various methods to check the connections : You can use a third party tool like Wireshack which lets you see what's happening on your network at a microscopic level and will help you in getting those encrypted connections. You can also use the Microsoft Network Monitor 3.4 to get those connection details. And as mentioned by travis you can also ...


1

Tom Li- MSFT described a solution to what sounds like your problem, but his solution was for SQL Server 2008. (But just how much has the installer been improved since then?) https://social.msdn.microsoft.com/forums/sqlserver/en-US/f009e660-503a-4569-a92d-9cc2ef790ca3/install-failure-certificate-chain-trust Key points from his post include: This ...


1

You have several options: If you want to encrypt the files containing the database you have dm-crypt included in the kernel to provide that kind of security https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt If your app its outside the database machine also you want to encrypt the communication, you can use the ssl option that its already included in ...


1

If you have MYSQL installed and running on a Windows Server, you may want to look into BitLocker with TPM encryption plus PIN boot password. Even if the host OS is Windows but the CentOS is a VM, then this would suffice. TrueCrypt VeraCrypt There's data-at-rest encryption so when it's at rest on a server disk partition not being accessed by some query, ...


1

ALTER DATABASE ENCRYPTION KEY Requires CONTROL permission on the database and VIEW DEFINITION permission on the certificate or asymmetric key that is used to encrypt the database encryption key. You must also add view definition according to MSDN. https://msdn.microsoft.com/en-us/library/bb630389%28v=sql.110%29.aspx


1

As of January 29th, Microsoft SQL Server supports TLS 1.2 for SQL Server 2008, SQL Server 2008 R2, SQL Server 2012 and SQL Server 2014 and major client drivers like Server Native Client, Microsoft ODBC Driver for SQL Server, Microsoft JDBC Driver for SQL Server and ADO.NET (SqlClient). Blog post about the release: ...


1

Don't confuse Oracle Advanced Security with encrypted SSL client connections to the database. The Advanced Security option is comprised of two main features, Data Radaction and Transparent Data Encryption. TDE is the encryption of data within tables, so that if someone captures the datafiles they won't be able to read table data in the clear inside the ...



Only top voted, non community-wiki answers of a minimum length are eligible