Encryption In SQL Server
-
Upload
joe-kuemerle -
Category
Technology
-
view
1.244 -
download
0
description
Transcript of Encryption In SQL Server
Encryption in SQL Server
By: Joe Kuemerle / @jkuemerle
www.preemptive.com / @PreEmptive
Background of Joe KuemerleLead Developer at PreEmptive Solutions
Over 15 years of development experience with a broad range of technologies
Focused on application and data security, coding best practices and regulatory compliance
Presenter at community, regional and national events.
What is encryptionEncryption is the process of mathematically
altering data in a consistent, reversible fashion. It should be used to store sensitive information that will need to be retrieved later. Encryption relies on a secret that is the only viable way to reverse the mathematical process
Encryption can be Symmetric where a single value (the encryption key) is used to both encrypt and decrypt the data
Or Encryption can be Asymmetric where there are two values in that data encrypted with Value 1 can only be decrypted with Value 2 and vice versa. This is also know as Public Key Encryption
What is encryption
“Encryption is the process of substituting a small secret in place of a large secret”
Symmetric Encryption
Asymmetric Encryption
CertificatesCertificates are used to store
asymmetric keys and consist of a private key and public key.
SQL Server provides built in management of certificates
Do not use use certificates to encrypt data, it is slow and can be vulnerable when storing lengthy values. Use a symmetric key to encrypt the data and a certificate to encrypt the symmetric key.
Hashes
HashesHashes are not an encryption method. A
hash takes an input value and transforms it to a unique value that is infeasible to convert back to the original value.
Hashes are not for storing data that needs to be re-read but are for proving knowledge of a secret without the actual secret being revealed.
Hashes are ideal for storing passwords as the password is not important but that the user prove that they know the password.
HashesThe .NET Framework includes
built in support for a number of hash functions
Best practices call for the use of SHA256, SHA384 or SHA512 functions
Do not use MD5 or SHA1as there are
proven methods for undermining the hash results.
Transparent Data Encryption
DemosYay! No more bullet points.
Questions
ReferencesLaurentiu Christofor:
http://blogs.msdn.com/lcris/Raul Garcia:
http://blogs.msdn.com/raulgaBruce Schneier:
http://www.schneier.com/http://
blogs.msdn.com/b/sqlsecurity/archive/2010/06/14/database-encryption-key-dek-management.aspx
Demo source: http://sqlcrypto.codeplex.com
Photo Creditshttp://
www.flickr.com/photos/wwworks/4612188594
http://www.flickr.com/photos/joyosity/3358614462
http://www.flickr.com/photos/jmrosenfeld/315825815
Feedback
http://speakerrate.com/jkuemerle @jkuemerle / [email protected]
Please fill out your evaluation form. Thanks!