Alternatives to SQL Server TDE

Question

Due to the high cost of SQL Server Enterprise Edition which includes the Transparent Data Encryption feature I am looking for an alternative product and have only found a couple of options:

• DbDefence
• NetLib Encryptionizer

Could anyone provide details of their experience with either of the above products (performance impact, ease of use, etc)?

Any other alternatives to SQL Server TDE?

Note: We are currently using SQL Server 2008 R2 Standard Edition.

Answer 1

We have quite some mixed servers, using encryption, depending upon the need of business. For very critical servers, we decided to upgrade to Enterprise edition as it not only provides TDE but other benefits as well when it comes to performance or troubleshooting.

Yes, TDE is quite effective and very good, but since it comes with a cost we decided for medium and low priority businesses to use a third party tool like NetLib.

I would like to highlight a few of its benefits, per our usage:

• Provides Transparent Data Encryption and Column Encryption for all versions of SQL Server from 2000 through 2014, and for all editions of SQL Server from Express through Enterprise. SQL Server's TDE is available only in the Enterprise edition of SQL Server 2008 and later.
• Easy to set up and maintain. Took us hardly 5-6 minutes to do so, once we were aware of what needs to be done.
• Database keys are stored outside of SQL Server, including alternate locations such as network, removable media, etc.
• Encryptionizer's Transparent Data Encryption has virtually no impact on database performance (<1%) on a properly sized server. Some benchmark reports show SQL Server TDE to have greater impact on performance between 5-10%.
• Support for FILESTREAMS (SQL Server 2008 and SQL Server 2014).
• Supports SQL Server Compressed Backups (WITH COMPRESSION).
• Possible to encrypt system databases including the master database and the tempdb database.

I have not heard much about DbDefence, but yes I believe it supports Replication, Log Shipping and Mirroring. Read here for more info.

I believe you can have a trial of the above products and decide as per the business needs which suits your environment the best.

Answer 2

I had to recently search information to encrypt the data without buying the Enterprise Edition, which is too much for our budget. Here's what I found:

Since SQL Server 2016 SP1, the Always Encrypted feature is included in express editions of SQL Server. It does not provide whole database encryption like TDE, DbDefence and NetLib Encryptionizer, you have to define the columns you want to encrypt. But it has the advantage of being done automatically. It can therefore be a nice alternative.

Another possibility is to encrypt directly the files with EFS or BitLocker. These two features are included in Windows.

For EFS, you have to define the files you want to encrypt, and only the user who encrypted the files can read/copy them (so you have to use the account which will run the SQL Server service.). But it can bring performance issues.

BitLocker encrypts the whole database but requires to have specific hardware: a TPM module in the server.

I have yet to test DbDefence and Encryptionizer but I'll update my answer when I do so.

Answer 3

As you pointed out there are two primary alternatives to TDE: Encryptionizer and DBDefence. They work very differently though: Encryptionizer sits between SQL Server and the operating system. DBDefence injects code into the running SQL Process using the (now defunct) Detours SDK. Both support all versions and editions of SQL Server. (Disclaimer: I am from NetLib Security).