RE: Encrypt data - SQL Server 2000

From: Eric McCarty (eric_at_lawmpd.com)
Date: 01/22/04

  • Next message: Shane Colley: "Microsoft Security (...how to reassure customers of)" 
    Date: Thu, 22 Jan 2004 07:59:00 -0800
To: "Fred Langston" <Fred.Langston@guardent.com>, "andreas" <andreas@san-andreas.com>, <silkm@hushmail.com>, <kcasey@nanoweb.com>, <focus-ms@securityfocus.com>

    While I agree EFS is a poor choice for this purpose. Should you have a
    "compromised admin account or rogue admin anywhere on your domain..." I
    think

    * Annual employee salaries
    * Commissions
    * Wages

    Would be the least of your worries.

    I suppose I've missed the intent of encryption within a SQL db. Why
    would you want to encrypt data inside a database?. First, if people can
    run queries against these tables and get results, you have incorrect
    database security. Second, if a malicious attacker uses a web app to run
    queries against the DB, the attacker would get the unencrypted output
    anyway as he/she is running in the context of an account that SHOULD
    have access.

    If we use the analogy of a book, if you can't get to the book, you can't
    read it. If the need comes about to send the text of the book across the
    wire, you should use SSL to encrypt it and decrypt it so people can't
    read it.

    Lastly, since when did business users dictate security? *Flame suit on!*

    Eric McCarty

    -----Original Message-----
    From: Fred Langston [mailto:Fred.Langston@guardent.com]
    Sent: Wednesday, January 21, 2004 9:34 AM
    To: 'andreas'; silkm@hushmail.com; kcasey@nanoweb.com;
    focus-ms@securityfocus.com
    Subject: RE: Encrypt data - SQL Server 2000

    EFS is probably the worst approach to this problem and should me avoided
    in
    all but the smallest installations when applied in this manner. You
    need
    encryption technology designed for this type of application, not a
    user/filesystem based encryption system.

    One compromised admin account or rogue admin anywhere on your domain and
    EFS
    is compromised as well. Performance is dismal as well if used for this
    purpose.

    EFS has it's place, but not here.

    Fred Langston, CISSP
      Senior Principal Consultant
      W: 206.903.8147 x223 F: 206.903.1862 M: 425.765.3330
      Seattle, WA www.Guardent.com
    ________________________________________
    G U A R D E N T
      Enterprise Security and Privacy Programs

    -----Original Message-----
    From: andreas [mailto:andreas@san-andreas.com]
    Sent: Tuesday, January 20, 2004 1:39 PM
    To: silkm@hushmail.com; kcasey@nanoweb.com; focus-ms@securityfocus.com
    Subject: RE: Encrypt data - SQL Server 2000

    True, but my SQL guys are my ASP programmers. While correct application
    of
    DB encryption would preclude the DBAs from mucking about in the data,
    they
    very well may be the ones implementing the technology.

    There are plenty of resources, Microsoft being one of them, but as to it
    being applicable, understandable or available that is a different story.
    Technet is of little help when trying to figure out how to employ EFS
    for
    database protection or even get an idea of the best practices for having
    a
    single encrypted table.

    Andreas

    -----Original Message-----
    From: silkm@hushmail.com [mailto:silkm@hushmail.com]
    Sent: Tuesday, January 20, 2004 4:27 PM
    To: kcasey@nanoweb.com; focus-ms@securityfocus.com;
    andreas@san-andreas.com
    Subject: RE: Encrypt data - SQL Server 2000

    Well the point here is the DBA's don't need to know anything about the
    encrypted data ... just have them create tables to hold it.

    You need to educate your progammers on how to encrypt it, and there are
    plenty of resources for that no matter what language you choose.

    -----Original Message-----
    From: andreas [mailto:andreas@san-andreas.com]
    Sent: Wednesday, 21 January 2004 1:19 AM
    To: 'Kevin E. Casey'; focus-ms@securityfocus.com
    Subject: RE: Encrypt data - SQL Server 2000

    Any good resources for researching/educating my DBAs? I have not had
    luck
    finding specific enough information on the subjects. My DB skills here
    are
    not as strong as I would like them to be, and not as strong as they will
    need to be in the future.

    Thanks!

    Andreas Barbiero
    CTO ETS/Financialcampus

    -----Original Message-----
    From: Kevin E. Casey [mailto:kcasey@nanoweb.com]
    Sent: Friday, January 16, 2004 12:01 PM
    To: focus-ms@securityfocus.com
    Subject: RE: Encrypt data - SQL Server 2000

    If you need to encrypt data in 3 columns and 3 columns only, your best
    bet
    is to do the encryption at the application (in its data tier) level.
    Using
    .NET (or other tools), gives you a good range/assortment of tools and
    sencryption schemes to encrypt that confidential data. This keeps your
    DBAs
    from snooping around. Keeps backup copies safe from prying eyes and it
    also
    keeps the performance hit for en/decryption at the client (or web server
    level).

     

    -----Original Message-----
    From: Nero, Nick [mailto:Nick.Nero@disney.com]
    Sent: Thursday, January 15, 2004 5:09 PM
    To: Eduardo.Ortiz@alderwoods.com; focus-ms@securityfocus.com
    Subject: RE: Encrypt data - SQL Server 2000

    Encrypting data on a database is tricky. If you must have table/row
    level
    encryption, then it is really tough to find a decent product and
    performance
    is abyssmal. I recently authored a document that proposes using
    Microsoft's
    own EFS to encrypt the whole volume where the Database is. This
    solution
    was easy, performed great (about 5-25% hit on performance compared to
    400%
    on DBCrypt) and best of all it is free. I would strongly recommend
    using
    Windows 2003 server for your SQL2k since its version of EFS uses AES at
    256bit. Otherwise you need to hack the reg on Win2k to enable 3DES
    encryption. Either is not gonna get cracked by someone anytime soon.
    The
    beauty of this solution is that you encrypt the database with the SQL
    Service account so that only that account can read the data. That way
    even
    an local admin on the box cannot access the data. You could even boot
    to a
    NTFS boot disk and the data would be encrypted. This depends on proper
    key
    management (as all crytpo plans do) so you have to ensure you use a
    domain
    account or roaming profile so the encryption key can not be exploited
    locally (see http://www.elcomsoft.com/aefsdr.html for more on this
    exploit)
    and domain recovery agent policy. Still we feel it delivers extremely
    secure databases, acceptable performance and zero cost.

    We tested several products and I believe DBEncrypt (or maybe DbCrypt)
    was
    one of them. They all were several thousand dollars per server (and
    that
    was for a license of over 100 servers), and would require massive
    hardware
    investments to compensate for the performance penalty. Like I said, If
    you
    must have row/table level encryption to protect against other DBA's then
    you
    are stuck. At that point I would say you should either limit who has SA
    access, or more strongly background check those that do cause that level
    of
    encryption will cost you far more. A DB on an encrypted drive with
    strong
    application level security (ie, custom views), would only be breakable
    at
    the app or by getting SA credentials. There are far easier targets out
    there.

    -----Original Message-----
    From: Eduardo.Ortiz@alderwoods.com [mailto:Eduardo.Ortiz@alderwoods.com]

    Sent: Thursday, January 15, 2004 1:02 PM
    To: focus-ms@securityfocus.com
    Subject: Encrypt data - SQL Server 2000

    Hello,

    We are implementing an Enterprise Data Warehouse. We already have data
    regarding different business process. Now we need to include Payroll
    data in
    our SQL Server (2000) database. Business users have specific security
    requirements about this sensitive data. They want to secure the
    following
    information:
    * Annual employee salaries
    * Commissions
    * Wages
    This information is stored in two tables and are three different
    columns. We
    have already implemented a tight security schema for the server,
    database
    and user groups (active directory), but business users want more
    security.
    Now we are planning to encrypt the data (just these three
    columns) in the database. I did not find any function in SQL Server to
    encrypt data. I found a tool provided by Application Security Inc
    (http://www.appsecinc.com) called DbEncrypt. Have you guys heard or
    worked
    with tool? Do you any suggestion or recommendation to encrypt the data?

    Thanks,
    Eduardo Ortiz

    --------------------------------------------------------------------- 

    ---
---
---------------------------------------------------------------------
---
---
---------------------------------------------------------------------
---
---
---------------------------------------------------------------------
---
---
---------------------------------------------------------------------
------
---------------------------------------------------------------------
------
---------------------------------------------------------------------
------
---------------------------------------------------------------------
------
Concerned about your privacy? Follow this link to get FREE encrypted
email:
https://www.hushmail.com/?l=2
Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434
Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Shane Colley: "Microsoft Security (...how to reassure customers of)"

    Relevant Pages

    • Re: Storing Connection String
      ... you can encrypt the traffic to the SQL Server. ... Hitchhiker's Guide to Visual Studio and SQL Server ... My idea is to have just one database user whose username and password ... Which means that if an user get hold of connection string ...
      (microsoft.public.dotnet.framework.adonet)
    • Re: How To Protect Backup being restoted in any others from other serv
      ... And I completely forgot about the 3:rd party utils which can encrypt along with compression on the fly. ... >> The only "security" feature provided by SQL Server is password. ... >> other servers (in case Database backup stolen from us). ...
      (microsoft.public.sqlserver.server)
    • Re: Secure data in SQL Server 2005 Mobile Edition
      ... One other thing to try is not checking the encrypt option - the database still gets encrypted if you provide a password. ... replicate this database on SQL Server Mobile Edition on a mobile device. ... and whatever the perf hit, well that's the price you pay. ...
      (microsoft.public.sqlserver.ce)
    • Re: Secure data in SQL Server 2005 Mobile Edition
      ... We have decided to go ahead with encrypted the entire database for now, ... replicate this database on SQL Server Mobile Edition on a mobile device. ... for my database connection string and checked the encrypt option. ...
      (microsoft.public.sqlserver.ce)
    • Re: Encrypting a table
      ... SQL CE database and encrypt that database. ... "glenn" wrote in message ... > using SQL Server CE? ...
      (microsoft.public.sqlserver.ce)
    • Quantcast