0

Can I secure SQL Server symmetric key from [sa] account? Can I create symmetric key using local user certificate via MMC?

Thanks

0

Can I secure SQL Server symmetric key from [sa] account?

Nope. The best you can do (and should be doing) is to:

  1. Rename SA
  2. Use Windows authentication only
  3. Disable SA (also see #2)

However, SA is just a login. The server roles of sysadmins gives full privileges over the system.

The only way to secure a symmetric key using SQL Server against a sysadmins is to use multiple encryption techniques involving the users and/or the application.

Note that always encrypted and HSMs use Asymmetric keys.

Can I create symmetric key using local user certificate via MMC?

That's not going to help you with this issue.

  • 1
    Note that if you encrypt the Symmetric Key with only a password, then a sysadmin would have debug the instance or attack the TRIPPLE_DES key derived from the password to open your Key. – David Browne - Microsoft Jan 3 '18 at 15:34
  • Correct @DavidBrowne-Microsoft I meant that as part of the "involving the users and or the application" part. If it's not clear enough I can break it out further. – Sean Gallardy Jan 3 '18 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.