4

A finding from a STIG evaluation, CCE-19832-5 reports that the [master] database should be encrypted with a Database Master Key using an encrypted password that meets DoD standards.

This a result of an AppDetective scan; it states:

Resource key 'database_containing_encrypted_key' not found.=[master].

I am not deliberately storing anything in the master database.

I've encrypted all user databases but my question is: do you encrypt the system databases, specifically master? I am using TDE with SQL Server 2012.

|improve this question
  • 3
    Where in the linked page does it talk about the master database at all? It says "the database master key" (for the specified database), not "the master database key" or "the database master key for the master database." In any case, what information are you putting into your master database that needs protecting? Only things I can think of are SQL auth password hashes, or if the names of your databases or logins reveal some proprietary secret. There are better fixes for those than applying TDE to master, IMHO. – Aaron Bertrand♦ Sep 25 '15 at 17:12
6

The answer is "NO".

When you attempt encrypt a system database, SQL Server complains:

Cannot encrypt a system database. Database encryption operations cannot be performed for 'master', 'model', 'tempdb', 'msdb' or 'resource' databases.

However, it's important to realize that any successful encryption of a non-system database will cause TempDB to be encrypted automatically, to protect temporary objects. In fact, even if TDE is later removed from the user database, TempDB will remain encrypted.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.