Secure SQL Database with TDE Thomas Chan SQL Saturday Raleigh

Thanks Vendors

How am I ?  Work for Virginia.gov as SQL DBA.  18+ year in IT.  Love computer, database and Sid Meier's Civilization.

Agenda  Why encrypt database ?  Where can I encrypt SQL database ?  What is TDE ?  How does it work ?  Pros and Cons !  Demos

Why encrypt database ?  Protect sensitive data against un-authorized user (OS and data store).  Compliance with standards and policies (business or legal).

Standards  PCI DSS – financial/payment (credit card).  HIPAA – health/medical.  FERPA – education and family.  Sarbanes-Oxley Act (SOX) – US corporation, accounting and communication.  PII – personal identifiable information.

Where can I encrypt SQL data(base) ? SQL functions TDE SSL

What is TDE ? Database TDE

What is TDE ?  One more layer to protect data.  Encrypt at page level on the fly. It means data, log and backup files are encrypted.  Does not encrypt columns or connections.  Algorithm: AES 128, 192, 256 and Triple DES

Encryption Hierarchy  Windows level: Data Protection API (DPAPI)  SQL Instance level: master key and certificate  Database level: database master key and encryption key

Encryption Hierarchy 2 SQL Instance Windows / OS Database

Encryption Hierarchy 3

Pros and Cons  Encrypt database files: backup, transaction log and data files  Protect data against lower level access like OS users  Low performance cost  It is transparent, no coding  Does not encrypt memory or file streams data  Does not encrypt connections  Must have SQL enterprise or developer edition PROS CONS

Other considerations  Always encrypt TempDB (pro or cons)  Master key dependency (may use SQL EKM capability or EKM software)  Works with high availability and disaster recovery options: failover clustering, mirroring and log shipping  Replication data is not encrypted when it travels between servers (plain text)  Does not work “well” with compression

Demo  Enable TDE  Disable TDE  Show data and backup file before and after in notepad  Monitor enabling operation  Restore database with TDE enabled in 2 nd instance  TDE working with log shipping

Demo 3  Sata 5400 rpm  1 GB  1 min 20 sec  SCSI rpm  much faster

Reference  Understanding TDE us/library/bb934049(v=sql.120).aspx  Protecting SQL Server Data – John Magnabosco Magnabosco/dp/  Extensible Key Management (EKM) us/library/bb895340(v=sql.120).aspx

Questions ?