Is encryption of SQL Server necessary or even recommended

From: Bob Clark (anonymous_at_discussions.microsoft.com)
Date: 10/30/03

  • Next message: Yoshihiro Kawabata: "How to deny DBCC SQLPERF(logspace)" 
    Date: Wed, 29 Oct 2003 19:40:36 -0800

    I saw a couple threads on here covering how to encrypt
    traffic between the client and the server. My question is
    a little different:

    We were recently gigged on a Vulnerability Assessment
    because none of our network traffic is encrypted. I'm
    looking at knocking out the low hanging fruit quickly so I
    though at encrypting SQL Server traffic. I know it can be
    done, I'd just like to know if it is necessary.

    Most of our DBs contain sensitive data which could cost us
    a lot of money if it were compromised. However, one of
    our application vendors told us we didn't need to encrypt
    the SQL Server communication because we were using it in
    an Intranet environment.

    My first thought is that an Intranet environment can
    quickly become compromised with the inadvertant
    installation of a trojan on the network.

    What does everyone else think?

  • Next message: Yoshihiro Kawabata: "How to deny DBCC SQLPERF(logspace)"

    Relevant Pages

    • Re: A cryptography solution for a client/server winforms app
      ... good idea if you want to learn crypto. ... you control both the client and server, you don't even need to use a ... code the client to ignore certificate trust errors. ... encrypt the memory stream. ...
      (microsoft.public.dotnet.security)
    • Re: A cryptography solution for a client/server winforms app
      ... You could use a self-signed cert deployed with the server ... code the client to ignore certificate trust errors. ... generate a hash value for the data in the memory stream. ... encrypt the memory stream. ...
      (microsoft.public.dotnet.security)
    • Re: Encrypted files do they work for backups?
      ... I'm going to test it out myself on my own test SBS Server. ... >>If I use the administrator account, and I encrypt it EFS on a External ... >>> format you need the private key to decrypt the files ... do you have the recovery agent Encrypting File ...
      (microsoft.public.windows.server.sbs)
    • Re: Cannot decrypt about 5% of encrypted files
      ... But when I try to decrypt them, ... It doesn't matter how I log into the server; ... copied to a cluster server that had a file share resource. ... When you encrypt on a server, ...
      (microsoft.public.security)
    • RE: Encrypt data - SQL Server 2000
      ... Encrypt data - SQL Server 2000 ... Encrypting data on a database is tricky. ...
      (Focus-Microsoft)