Using TDE and SQL Server 2016 AlwaysOn Availability Groups

Question

We currently use SQL Server 2012 AG are in process of migrating to SQL 2016. We use EMC SAN for storage and it provides the data encryption at rest on hardware level. Some folks are thinking about start using TDE that also provides encryption at rest only that we already have.

While it's not so difficult to implement TDE, it, in my opinion, creates a lot headache in terms of managing and administrating. From your experience, is it good idea to use TDE in our situation? Is it worth? How well TDE compatible with AlwaysOn AGs? I read, for example, you can't use AG GUI to do anything. Everything has to be done through scripts.

Answer 1

From your experience, is it good idea to use TDE in our situation?

No idea, you didn't tell us the attack vectors you are looking to secure. In the rest of my answers, I'll assume the only attack vector is on disk at rest.

Is it worth?

If you're already running Enterprise Edition (which is required) then there is no direct extra cost. There will obviously admin cost for it in terms of your working hours.

How well TDE compatible with AlwaysOn AGs?

It's 100% compatible.

We use EMC SAN for storage and it provides the data encryption at rest on hardware level.

What happens when the backups, data files, etc., are moved off the SAN? What about backups in transit over network?

I read, for example, you can't use AG GUI to do anything.

In older versions of SSMS, that's correct. This has been fixed for a while.

Everything has to be done through scripts.

I don't see why that's a bad thing, though.