1. Secure SQL Database with TDE Thomas Chan SQL Saturday 445 - Raleigh

2. Thanks Vendors

3. How am I ?  Work for Virginia.gov as SQL DBA.  18+ year in IT.  Love computer, database and Sid Meier's Civilization.

4. Agenda  Why encrypt database ?  Where can I encrypt SQL database ?  What is TDE ?  How does it work ?  Pros and Cons !  Demos

5. Why encrypt database ?  Protect sensitive data against un-authorized user (OS and data store).  Compliance with standards and policies (business or legal).

6. Standards  PCI DSS – financial/payment (credit card).  HIPAA – health/medical.  FERPA – education and family.  Sarbanes-Oxley Act (SOX) – US corporation, accounting and communication.  PII – personal identifiable information.

7. Where can I encrypt SQL data(base) ? SQL functions TDE SSL

8. What is TDE ? Database TDE

9. What is TDE ?  One more layer to protect data.  Encrypt at page level on the fly. It means data, log and backup files are encrypted.  Does not encrypt columns or connections.  Algorithm: AES 128, 192, 256 and Triple DES

10. Encryption Hierarchy  Windows level: Data Protection API (DPAPI)  SQL Instance level: master key and certificate  Database level: database master key and encryption key

11. Encryption Hierarchy 2 SQL Instance Windows / OS Database

12. Encryption Hierarchy 3

13. Pros and Cons  Encrypt database files: backup, transaction log and data files  Protect data against lower level access like OS users  Low performance cost  It is transparent, no coding  Does not encrypt memory or file streams data  Does not encrypt connections  Must have SQL 2008+ enterprise or developer edition PROS CONS

14. Other considerations  Always encrypt TempDB (pro or cons)  Master key dependency (may use SQL EKM capability or EKM software)  Works with high availability and disaster recovery options: failover clustering, mirroring and log shipping  Replication data is not encrypted when it travels between servers (plain text)  Does not work “well” with compression

15. Demo  Enable TDE  Disable TDE  Show data and backup file before and after in notepad  Monitor enabling operation  Restore database with TDE enabled in 2 nd instance  TDE working with log shipping

16. Demo 3  Sata 5400 rpm  1 GB  1 min 20 sec  SCSI 15000 rpm  much faster

17. Reference  Understanding TDE https://msdn.microsoft.com/en- us/library/bb934049(v=sql.120).aspx  Protecting SQL Server Data – John Magnabosco http://www.amazon.com/Protecting-Server-Data-John- Magnabosco/dp/1906434271  Extensible Key Management (EKM) https://msdn.microsoft.com/en- us/library/bb895340(v=sql.120).aspx

18. Questions ?