I'm a bit understand that TDE encryption protect the database from being stolen and read by a hacker. However, I don't understand if it can help me in this scenario: If a hacker got into my server and he got the Administrator privilege. Now he want to access the database to stolen information. He won't need to copy the entire database file which being encrypted. But he can reset the SQL SA password or read the connection string from a website .config file , and use tool like SQL Server Management Studio to access the database from that user and password, finally he use few SQL query to view the data or export it to disk. Is that possible?

  • someone with sa on your box can just reset your keys or remove encryption (and wait for it to decrypt). They still have to get a way to send your data elsewhere so make sure your DB server cannot get out to the internet. Rotate your sa pwd and keys often, no one should have them. Back them up accordingly. – JDPeckham Dec 15 '18 at 16:01

[…]Is that possible?

Yes. The scenario where a server is compromised is not what is being targeted by TDE. TDE is targeting data at rest scenarios such as lost/stolen backups, hard drives that were discarded and not scrubbed, etc., but not entire server compromises.

In this case I'd advocate for you to upgrade off of 2008R2 (which only has <6 months of support left) and onto something much newer. There you have options such as column level encryption through HSMs and Always Encrypted (which can also use HSMs) which would be two main scenarios that can potentially (depending on external factors) stop the attack you've specified from being able to steal any extra information not already on the server and unencrypted.

  • If hard drives that were discarded. They can clone the entire drive. Open the computer with entire drive cloned, reset administrator password using cmd and got the administrator privilege and finally got the database? So it does not protect me in this case too? – joe Dec 15 '18 at 2:42
  • @joe You're assuming the discarded drives are of the entire server including operating system. If that's the case then it's not different than having access to the server. If the discarded drives are the databases files or partial files and not the entire OS + database + binaries + etc., then it would prevent it. – Sean Gallardy Dec 15 '18 at 2:45

If someone gets administrator permission there is very little you can do... TDE will keep you safe in case someone physically stole your disks (or copied the files), and tries to attach them to a different instance where he/she is already admin. See the documentation for a thorough discussion of how TDE works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.