Encryption; SQL Server 2005 & Windows 2003 Server

Any further input would be appreciated ...

Pro EFS:

Indexs, Primary Keys, Foreign Keys, DEFAULTS, CHECK CONSTRAINTS are preserved.

Databases modifications need not consider Encryption.

Patterns & Practices

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag/html/scag-ch05.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/THCMCh18.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/CL_SecDBSe.asp

Other Technical Articles

http://www.microsoft.com/technet/prodtechnol/sms/smssp2/spsecurity/3f42c1d3-9857-4cae-b18a-231017568070.mspx?mfr=true
http://www.microsoft.com/technet/prodtechnol/sql/2000/reskit/part3/c1061.mspx?mfr=true
http://www.microsoft.com/technet/archive/security/chklist/sql2ksrg.mspx?mfr=true
http://www.microsoft.com/sql/prodinfo/previousversions/securingsqlserver.mspx
http://www.microsoft.com/technet/prodtechnol/sql/2000/maintain/sp3sec02.mspx
http://www.microsoft.com/technet/prodtechnol/sql/2000/maintain/sp3sec04.mspx
http://www.microsoft.com/technet/prodtechnol/sql/2000/deploy/sqlorcle.mspx
http://www.microsoft.com/technet/security/topics/cryptographyetc/efs.mspx
http://www.sqlservercentral.com/columnists/bkelley/implementing_efs.asp
http://www.microsoft.com/technet/prodtechnol/sql/2005/multisec.mspx
http://www.akadia.com/services/sqlsrv2ora.html#_Toc513865376
http://www.sans.org/top20/2002/mssql_checklist.pdf

Case Study

http://www.microsoft.com/canada/casestudies/worksafebc.mspx


Anti-EFS:

1. If the file is not created in an Encrypted Directory the temporary file
created by EFS during encryption remains in clear-text and is
vulnerable.

a) cipher.exe /W must be used to Wipe the temporary file.

2. EFS will not function in a Clustered Environment.

3. If the Server crashes when an Encrypted File is open the pagefile.sys
will
contain vulnerable clear-text of the Encrypted File on restart.

4. The Windows Administrator(s) can "Set Password ..." of the Key Owner
and the Key Owner will not be able to access the data.

5. If the Key Owner does not specify a Data Recovery Agent (DRA) AND does
not backup the PKI the data might become inaccessible under
circumstances
such as "4." above.

6. Encrypted Files cannot be backed up to non-NTFS devices except with
Windows
Backup utilities.

7. Extra steps must be taken over-and-above conventional SQL Server Backup,
Recovery and Disaster Recovery procedures.

8. The Windows Administrator can access the (otherwise) encrypted data if
SQL Server "BUILTIN\Administrators" is not removed.

9. The Database *.mdf & *.ldf files cannot be moved between domains and
retain
the Encrypted Attribute.

10. Stealing a local account password is easy using common hacker tools in
standalone mode.

11. Encrypted files stored on file servers are decrypted on the server
and then
transported in clear text across the network to the user's workstation.
Because EFS needs access to the user's private key, which is held in
the
profile, the server must be "trusted for delegation" and have access to
the user's local profile.

a) Requires IPSec to secure the file transfer between file server
and
user machine.

12. "The EnCase EFS Module provides Encrypting File System (EFS) folder and
file decryption capabilities, for locally authenticated users."
(http://www.digitalintelligence.com/software/guidancesoftware/encase/)

.

Relevant Pages

  • Re: Serious EFS Issue
    ... user's information it copied her Documents and Settings to the 2003 server. ... I am also using folder redirection with her My Documents folder, ... where I am having issues with her data encryption. ... > for use with EFS (use the account to look in the Certificates ...
    (microsoft.public.windows.server.security)
  • Re: Using EFS for laptops in a domain
    ... to avoid EFS on the server except for some very specialized uses. ... but then I couldn't set or clear the encryption ... I'll give the folder disabling ...
    (microsoft.public.windowsxp.security_admin)
  • Re: 2 GB for free online backup
    ... Thanks for all the replies, Larry, David, and R.McCarty. ... Server data backup. ... PS--any reputable company uses customer-controlled encryption and the ...
    (microsoft.public.windowsxp.general)
  • Re: 2 GB for free online backup
    ... Removable hard drives two of them, best if encrypted, are a much better ... Server data backup. ... PS--any reputable company uses customer-controlled encryption ...
    (microsoft.public.windowsxp.general)
  • Re: Using EFS for laptops in a domain
    ... Another good place to post EFS ... But the real test is dragging an encrypted file into the folder. ... when I drag it to the correct spot on the server, ... I don't want to disable encryption on the server, ...
    (microsoft.public.windowsxp.security_admin)