Hot answers tagged

9

The attacker will get the data unencrypted. The T in TDE stands for "transparent". The user will never see encrypted data. The database transparently decrypts it when it is read from disk and transparently encrypts it when writing to disk. If your application is insecure, TDE doesn't help you plug those application security holes. You need to fix those ...


7

SQL Server supports SSL 3.0 and TLS 1.0 only, you must have at least one of them enabled or SQL Server will not be able to start. SQL Server does not support TLS 1.1, 1.2 etc, it specifically uses TLS 1.0. Your options here are to enable SSL 3.0 and/or TLS 1.0, no other way around it I'm afraid. Cheers Mat


6

As in the other answer: you need a recent CU for TLS1.2. See https://support.microsoft.com/en-us/kb/3052404: Cumulative Update 8 for SQL Server 2014 Cumulative Update 1 for SQL Server 2014 SP1 Cumulative Update 6 for SQL Server 2012 SP2 Cumulative Update 7 for SQL Server 2014 After enabling only TLS 1.2 you will possibly encounter two errors: SQL ...


5

Do not disable TDE. Besides being a lengthy size-of-data operation, it was established initially for a reason and you may be breaking whatever compliance/operations reason exists for TDE. Rather set up log shipping properly in presence of TDE. Follow the steps described in Move a TDE Protected Database to Another SQL Server. You are going to export the TDE ...


4

Whether encrypted RDs is disk/file level encrypted or db level encrypted? I have done some searching, but could bot able to get a clear answer. The encryption is done at the file/disk level. From this page, emphasis mine: Amazon RDS encrypted instances provide an additional layer of data protection by securing your data from unauthorized access to ...


4

Server1 running SQL Server 2012 with Service Master Key A, db1 with Database Master Key 1, symmetric key and certificate available. I assume that the db1 master key is encrypted with the SMK. This makes everything encrypted by the database master key 'available' to applications, w/o having to explicitly open the database master key. What you need to do ...


4

You can join on the certificate thumbprint: use master; go select database_name = d.name, dek.encryptor_type, cert_name = c.name from sys.dm_database_encryption_keys dek left join sys.certificates c on dek.encryptor_thumbprint = c.thumbprint inner join sys.databases d on dek.database_id = d.database_id; My sample output: database_name ...


3

This is not an ASYMMETRIC KEY, it is a SYMMETRIC KEY. Change GRANT REFERENCES ON ASYMMETRIC KEY to GRANT REFERENCES ON SYMMETRIC KEY


3

To create a certificate for SSL encryption for SQL Server you need a certificate for Server authentciation. That is [EnhancedKeyUsageExtension] OID = 1.3.6.1.5.5.7.3.1 If you want to manually create a certificate for this using Windows Certificate services you need to do it like this. ...


3

My boss ask me for possibilities to do the encryption on content DB level, it backup. or on column level? This is something you and You're boss need to sit and discuss on as what could be pros and cons of using TDE or Cell level encryption: However Few points to note: TDE does not offer the granularity of protection that cell-level encryption ...


3

Yes, stay away from the sp_OA* OLE Automation procedures. If you want / need to handle this purely within SQL Server then you can do so using SQLCLR, which replaces the sp_OA* OLE Automation procedures. And if you aren't using xp_cmdshell for anything else, then no need to enable it just for this (although to be fair, if using SQL Agent, then a CMD step ...


3

The files are stored in a blob in the sharepoint database and as TDE encrypts all the pages in the database all the files will be encrypted there within. It's important to notice that while the database is mounted on the server the database server will serve the files unencrypted to the Sharepoint application server and it's clients. The Sharepoint ...


3

Even if you configured RBS to use FILESTREAM, TDE does not apply to FILESTREAM: Transparent Data Encryption and FILESTREAM DATA FILESTREAM data is not encrypted even when TDE is enabled.


3

Well we have quite a mixed servers,using encryption, depending upon the need of business. For very critical we decided to upgrade to enterprise as it not only provides TDE but other benefits as well when it comes to performance or troubleshooting. Yes, TDE is quite effective and very good, but since it comes with a cost we decided for medium and low ...


3

As far as my testing goes (using SQL Server Express 2014, SP1 and SQL Server Developer 2012 SP2, both 64-it), the formula when not using an authenticator for the return value (VARBINARY) length of: ENCRYPTBYPASSPHRASE('_My_PassPhr@zE_yo_', {anything}) is: 28 + (8 * (DATALENGTH(@ClearText) / 8)) Try the following: DECLARE @ClearText VARCHAR(8000); SET ...


2

From TechNet sys.dm_exec_connections DMV: the encrypt_option will display FALSE if the connection is not encrypted.


2

TDE will add a little extra CPU cost to the server but that's marginal on current CPUs. It will however only protect the data at rest, but that's including backups of the databases. It's fully compatible with failover clustering and AlwaysOn but you have to make sure that all nodes in AlwaysOn are configured correctly ...


2

Note that encryption of modules in SQL Server is not really encryption; it is more like weak obfuscation. Anyone with a search engine and a few minutes to kill can reverse engineer your objects, so encrypting them is almost completely pointless. DENY VIEW DEFINITION is far more effective here (as well as not giving your developers sysadmin and other ...


2

I have dealt a lot with PCI and HIPAA recently since we've developed the ApexSQL Audit compliance tool (some details about the tool can be found here), and during a few years of working on the tool and demoing the tool, I was engaged in numerous discussions about the status of DBA in relation to compliance rules. PCI and HIPAA are not developed to deal with ...


2

I supported PCI and HIPPA compliant data as a DBA contractor for the Air Force and as a consultant for hospitals. It is part of a DBA's job to have access to data, whether it is encrypted or not. The PCI compliance data was encrypted by the application, but I could still see it decrypted because I had access to the DLL that handled it...quick PowerShell ...


1

While it's true the SQL needs one of these enabled, there's a workaround. Open gpedit.msc. In the Local Group Policy Editor, double-click Windows Settings under the Computer Configuration node, and then double-click Security Settings. Under the Security Settings node, double-click Local Policies, and then click Security Options. In the details pane, ...


1

TDE only encrypts the data at rest. If they have the access to connect to the server and query the database then they can get to the data. But I don't think the person running the patch (CU or Service Pack) needs permissions to the database proper, just permissions on the server. The only way to separate the job functions as you seem to want would be to ...


1

I've used TDE in production many times and it in no way affects Windows/SQL Server patching unless there's some horrific bug or something of the sort; which has not yet happened. TDE simply uses the Windows DPAPIs to generate a cert in Master that then is used to make other certs which can encrypt/decrypt the remaining DB data at rest. Heads up though, ...


1

ALTER DATABASE ENCRYPTION KEY Requires CONTROL permission on the database and VIEW DEFINITION permission on the certificate or asymmetric key that is used to encrypt the database encryption key. You must also add view definition according to MSDN. https://msdn.microsoft.com/en-us/library/bb630389%28v=sql.110%29.aspx


1

If you have MYSQL installed and running on a Windows Server, you may want to look into BitLocker with TPM encryption plus PIN boot password. Even if the host OS is Windows but the CentOS is a VM, then this would suffice. TrueCrypt VeraCrypt There's data-at-rest encryption so when it's at rest on a server disk partition not being accessed by some query, ...


1

You have several options: If you want to encrypt the files containing the database you have dm-crypt included in the kernel to provide that kind of security https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt If your app its outside the database machine also you want to encrypt the communication, you can use the ssl option that its already included in ...


1

Don't confuse Oracle Advanced Security with encrypted SSL client connections to the database. The Advanced Security option is comprised of two main features, Data Radaction and Transparent Data Encryption. TDE is the encryption of data within tables, so that if someone captures the datafiles they won't be able to read table data in the clear inside the ...


1

Using a password inside the script is a really bad idea as this can be seen in ps aux and read out by every system user. I would suggest you to look into mysqldump-secure. This is a shell script that does openssl encryption based on public-private key encryption and is a lot more performant than gpg. Additionally it will compress your databases and writes a ...


1

(OK, this is not an answer. Rather it is a warning that the question reflects a need for far more research.) Lock your doors, but don't bother to lock your windows. If you have a laptop with Social Security Number on it and it gets stolen, it won't matter if the data is super-duper-encrypted -- the decryption key is sitting somewhere in the laptop! You ...


1

If you have SQL Server Standard edition then you do not have Encryption built into the product. You have other options as the articles you reference mention, but they require work on your part to implement. I think the confusion is where you are seeing that you can implement column/cell encryption using Enterprise edition OR through alternative methods. ...



Only top voted, non community-wiki answers of a minimum length are eligible