Tag Info

Hot answers tagged

6

SQL Server supports SSL 3.0 and TLS 1.0 only, you must have at least one of them enabled or SQL Server will not be able to start. SQL Server does not support TLS 1.1, 1.2 etc, it specifically uses TLS 1.0. Your options here are to enable SSL 3.0 and/or TLS 1.0, no other way around it I'm afraid. Cheers Mat


4

Server1 running SQL Server 2012 with Service Master Key A, db1 with Database Master Key 1, symmetric key and certificate available. I assume that the db1 master key is encrypted with the SMK. This makes everything encrypted by the database master key 'available' to applications, w/o having to explicitly open the database master key. What you need to do ...


3

My boss ask me for possibilities to do the encryption on content DB level, it backup. or on column level? This is something you and You're boss need to sit and discuss on as what could be pros and cons of using TDE or Cell level encryption: However Few points to note: TDE does not offer the granularity of protection that cell-level encryption ...


3

To create a certificate for SSL encryption for SQL Server you need a certificate for Server authentciation. That is [EnhancedKeyUsageExtension] OID = 1.3.6.1.5.5.7.3.1 If you want to manually create a certificate for this using Windows Certificate services you need to do it like this. ...


3

This is not an ASYMMETRIC KEY, it is a SYMMETRIC KEY. Change GRANT REFERENCES ON ASYMMETRIC KEY to GRANT REFERENCES ON SYMMETRIC KEY


3

Yes, stay away from the sp_OA* OLE Automation procedures. If you want / need to handle this purely within SQL Server then you can do so using SQLCLR, which replaces the sp_OA* OLE Automation procedures. And if you aren't using xp_cmdshell for anything else, then no need to enable it just for this (although to be fair, if using SQL Agent, then a CMD step ...


3

Well we have quite a mixed servers,using encryption, depending upon the need of business. For very critical we decided to upgrade to enterprise as it not only provides TDE but other benefits as well when it comes to performance or troubleshooting. Yes, TDE is quite effective and very good, but since it comes with a cost we decided for medium and low ...


3

Even if you configured RBS to use FILESTREAM, TDE does not apply to FILESTREAM: Transparent Data Encryption and FILESTREAM DATA FILESTREAM data is not encrypted even when TDE is enabled.


3

The files are stored in a blob in the sharepoint database and as TDE encrypts all the pages in the database all the files will be encrypted there within. It's important to notice that while the database is mounted on the server the database server will serve the files unencrypted to the Sharepoint application server and it's clients. The Sharepoint ...


3

Yes. Transparent Data Encryption doesn't change any of the internal processing of queries. Database pages are transparently encrypted/decrypted during I/O (i.e. when they are read from or written to disk). In-memory query processing is therefore unaffected, so indexes continue to function exactly as they did without TDE. TDE is designed to negate the need ...


2

I primarily use them when I'm moving or copying a database to a new instance of SQL Server. In that case, the DMK in the database will be re-encrypted with the new instance's service master key, but the objects encrypted by the DMK (in your case, the symmetric keys) will not be updated accordingly. You'll need to restore the DMK from a separate backup using ...


2

You can join on the certificate thumbprint: use master; go select database_name = d.name, dek.encryptor_type, cert_name = c.name from sys.dm_database_encryption_keys dek left join sys.certificates c on dek.encryptor_thumbprint = c.thumbprint inner join sys.databases d on dek.database_id = d.database_id; My sample output: database_name ...


2

PostgreSQL comes to my mind. You have pgcrypto library for encrpyting data and there are drivers for .Net


2

I supported PCI and HIPPA compliant data as a DBA contractor for the Air Force and as a consultant for hospitals. It is part of a DBA's job to have access to data, whether it is encrypted or not. The PCI compliance data was encrypted by the application, but I could still see it decrypted because I had access to the DLL that handled it...quick PowerShell ...


2

While it's true the SQL needs one of these enabled, there's a workaround. Open gpedit.msc. In the Local Group Policy Editor, double-click Windows Settings under the Computer Configuration node, and then double-click Security Settings. Under the Security Settings node, double-click Local Policies, and then click Security Options. In the details pane, ...


2

I completely agree with the response Federico Razzoli, except for one thing. Indeed, hashing must be performed upstream, in any case not at the database level (so your question is probably off topic). However simply using a hash function is not sufficient in terms of security. You remain vulnerable to dictionary attacks, rainbow table attacks, and some ...


1

You can use SHA512. I see that you used the "mysql" tag. Please, don't use the SHA2() SQL function, or any other SQL hash function. If you do so, the plain strings will be sent across the net, and probably written in some logs. Use the PHP hash() function instead, and specify 'sha256' as first parameter.


1

TDE will add a little extra CPU cost to the server but that's marginal on current CPUs. It will however only protect the data at rest, but that's including backups of the databases. It's fully compatible with failover clustering and AlwaysOn but you have to make sure that all nodes in AlwaysOn are configured correctly ...


1

I've used TDE in production many times and it in no way affects Windows/SQL Server patching unless there's some horrific bug or something of the sort; which has not yet happened. TDE simply uses the Windows DPAPIs to generate a cert in Master that then is used to make other certs which can encrypt/decrypt the remaining DB data at rest. Heads up though, ...


1

TDE only encrypts the data at rest. If they have the access to connect to the server and query the database then they can get to the data. But I don't think the person running the patch (CU or Service Pack) needs permissions to the database proper, just permissions on the server. The only way to separate the job functions as you seem to want would be to ...


1

Microsoft's MSDN blog has a table describing the possible conditions and their outcomes. See Selectively using secure connection to SQL Server to understand client side setting and connection property options impacting secure connections for just the client involved. The server and other clients are not impacted.


1

I got a SaaS product and the data is kinda sensitive. I want to give my customers 100% security on the fact that I can't read their data. If it's software as a service, and you do more than simply store blobs of data then give those blobs back when the customer asks, this is pretty much impossible. You're dreaming. You can't realistically combine SaaS ...


1

If you are receiving the thumbprint error the certificate was not created properly from the Source Server's Cert/Key backups. I found this question which was already answered with a solution for you: Restore encrypted database to another server



Only top voted, non community-wiki answers of a minimum length are eligible