RE: Encrypt data - SQL Server 2000

From: Mr. Momotaro (momotaro_at_catholic.org)
Date: 01/22/04

  • Next message: Eric McCarty: "RE: Encrypt data - SQL Server 2000" 
    Date: Thu, 22 Jan 2004 10:47:37 -0500 (EST)
To: focus-ms@securityfocus.com

    > EFS is probably the worst approach to this problem and should me avoided
    > in
    > all but the smallest installations when applied in this manner. You need
    > encryption technology designed for this type of application, not a
    > user/filesystem based encryption system.
    >

    I'll piggy-back here that EFS doesn't cut it. EFS doesn't stop the DBAs
    from seeing the data. EFS has to be configured in such a way SQL Server
    has access to the file. Since SQL Server has access, the DBA will be able
    to see into the table. Therefore, EFS will stop someone from stopping the
    SQL Server service and copying off the data file if they are familiar with
    this approach but aren't familiar with EFS.

    The last time I talked to someone from Microsoft about this (a couple of
    years ago, albeit), I believe Protegrity (http://www.protegrity.com/) was
    the recommendation for encrypting at the table or column level.

    Yes, you're going to suffer a performance hit because SQL Server won't be
    able to index on the data, but there's always a trade-off.

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Eric McCarty: "RE: Encrypt data - SQL Server 2000"

    Relevant Pages

    • Re: Encription for MDF files
      ... EFS by itself is not a complete solution. ... If the box is stolen - including the EFS recovery keys, ... then encrypt it before it is stored and decrypt it when retrieving. ... > 1) Logon with the SQL Server startup account ...
      (microsoft.public.sqlserver.security)
    • Re: Protecting database from administrators
      ... > there is no encryption while at rest it must still be secure. ... It would certainly be nice if SQL Server provided more encryption facilities, ... > All the security MS has offered is weak. ... You refer to EFS. ...
      (microsoft.public.sqlserver.security)
    • Re: Password protecting database and keeping on a removable media.
      ... With EFS, the Certificate present in a specific Active Directory based user ... Mike Epprecht, Microsoft SQL Server MVP ...
      (microsoft.public.sqlserver.server)
    • Re: Encryption
      ... For column-level encryption, there are lots of 3rd party options available. ... We're currently running SQL Server 2000. ... We have also looked at the possibility of using EFS for the data storage ...
      (microsoft.public.sqlserver.security)
    • RE: How can I encrypt the MDF file
      ... Even using EFS it would be possible to copy the mdf file ... attach to another instance of SQL server ... >that service account. ...
      (microsoft.public.sqlserver.security)