New answers tagged

2

If you want to restore on a different server, you should be able to do so with the certificate, private key and database backup file(s). When a certificate is created in any database in SQL Server, it is part of an encryption hierarchy. The certificate itself only contains a public key, which needs no protection, however, the database will also contain a ...


1

With security in SQL Server, one needs to be very watchful that permissions are not indirectly granted when not intended. Designing granular permissions for the SQL Server system must be a very meticulous task for Microsoft. Once created, the certificate can be altered, but only to drop the private key. View definition lets the user see the metadata, however ...


1

SQLmojoe has good points in the answer. 2 things that you need to consider : The cert that you used when taking backup should be preserved as is. The cert should not be changed or renewed (even if it is expired). Renewing the cert will change the cert thumbprint and you wont be able to restore the database backup. The user account should have VIEW ...


1

Assuming you have the process down tight (as in scripted, tested, re-tested, and tested with the newest and most junior persons on the team) the only other area that I seen people slip on is accessibility of the key. Most people get that they should not store it in the same place as the backup files or even transport them together. What is sometimes missed ...


8

We have recently implemented TDE along with AlwaysON in Production running SQL Server 2014. In our application, we noticed a slight (1-3%) increase in CPU utilization. Your environment is different, so do a thorough load testing with some realistic PROD datasize. Takeaways from embracing TDE : Backup compression and TDE does not go hand in hand i.e. You ...


3

To find items associated with Certificates and Asymmetric Keys, first try the query posted in this DBA.SE Answer: Find signed procedures, functions, triggers, assemblies and by which certificates / asymmetric keys If that does not return any objects, next try the following queries which look for: Logins Users Service Broker Endpoints Database Mirroring ...


0

Transparent data encryption guarantees the data is always encrypted at rest, implying even the backups are encrypted, no matter where they are physically stored, be it tape, disk, a DVD, etc. Encrypting data at rest is a great way to control who sees the data, even if someone misplaced an entire copy of the database or a steals a database backup.



Top 50 recent answers are included