Category: Security

Matthew McGiffen retrieves some data:

In this post we’ll look at how you interact with data that is encrypted using Always Encrypted. The examples here will show how you run queries from SSMS, in later posts we’ll look at stored procedures and application code – as well as what happens in the background when you execute a query.

For these examples we’re going to be using the database we created in the last post.

Always Encrypted definitely changes the way you work with those encrypted columns, and you might run into some frustrating errors along the way, as things you could get away with before are no longer possible.

Comments closed

Eitan Blumin has some myths for us:

Many organizations assume that their SQL Server is secure because it is behind a firewall. However, firewalls only block traffic to specified ports and protocols, and they do not protect against attacks that come through allowed traffic. Therefore, it’s important to secure SQL Server at a more granular level.

Furthermore, even if your SQL Server is not connected to the internet, it can still be hacked through internal attacks or by using compromised devices that connect to your network… If at least one privileged user can connect to the SQL Server, that means a malicious attacker potentially could do the same.

My one quibble is that number 5 isn’t a myth. I accept the importance of performing auditing, and people I know who have insane transactional throughput requirements still perform auditing, but there certainly is a performance effect. Otherwise, definitely worth the read.

1 Comment

Matthew McGiffen sets up Always Encrypted on a SQL Server instance:

In this post we’re going to go through the steps to set up Always Encrypted and create an encrypted column. As with my last post we’re looking at the flavour of Always Encrypted without enclaves, we’ll look at working with enclaves in detail later on.

It is a straightforward process to set up everything required for Always Encrypted. In fact, there is a wizard provided in SQL Server Management Studio (SSMS) that will do it all for you. In these examples, however, we will focus on performing the individual steps manually as that gives you a better view of what is going on. For all the objects involved we’ll look in detail at what is created so that you have a good level of understanding.

Click through for the instructions.

Comments closed

Matthew McGiffen describes a product:

Always Encrypted was a new encryption feature added to SQL Server with the 2016 version of the product. Initially it was just available in enterprise edition, but from SQL Server 2016, SP1 was made available in standard edition also.

Unlike TDE which encrypts the whole database, Always Encrypted is a form of column encryption that means you choose which columns of data you want to encrypt. The “Always” part of Always Encrypted refers to the fact that data is encrypted at rest, in memory, and as it is transmitted across the network. That means that it provides the highest level of protection possible for your data.

Read on to learn more about what makes it different from other forms of encryption in SQL Server and the way this feature works.

Comments closed