Scribd
Upload
7 views18 pages

DBA Training Session: Name: Designation: Date:: TDE N Sanjay Kumar SQL Dba 14 April 2023

The document outlines a training session on Transparent Data Encryption (TDE) for SQL Database Administrators, covering its definition, benefits, and operational details. It emphasizes the importance of data protection, compliance with standards, and the encryption hierarchy involved in TDE. Additionally, it discusses the pros and cons of TDE, including its performance impact and considerations for implementation.

Uploaded by

Sam Sanjay
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
7 views18 pages

DBA Training Session: Name: Designation: Date:: TDE N Sanjay Kumar SQL Dba 14 April 2023

The document outlines a training session on Transparent Data Encryption (TDE) for SQL Database Administrators, covering its definition, benefits, and operational details. It emphasizes the importance of data protection, compliance with standards, and the encryption hierarchy involved in TDE. Additionally, it discusses the pros and cons of TDE, including its performance impact and considerations for implementation.

Uploaded by

Sam Sanjay
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 18

DBA Training Session: TDE

Name: N SANJAY KUMAR


Designation: SQL DBA
Date: 14th April 2023
Always ask Questions

Presentati
on Interrupt Me

Rules This is a two-way


conversation, let’s learn from
each other’s experiences.
2
Agenda
• What is TDE?
• Where can I do data encryption ?
• Why encrypt database ?
• Where TDE act?
• How does it work ?
• SSMS user interface.
• Pros and Cons.
What is TDE?
• Transparent data encryption (TDE)
• TDE stores the entire database in an encrypted format.

4
Where can I do encryption?

SQL functions
SSL EncryptByKey, DecryptByKey
Bit Locker

TDE
Why encrypt database ?
• Protect sensitive data against un-authorized lower-level user (OS,
virtual machine or storage)
• Compliance with standards and policies (business or legal)
Standards
• PCI DSS – financial/payment (credit card)
• HIPAA – health/medical
• FERPA – education and family
• Sarbanes-Oxley Act (SOX) – US corporation, accounting and
communication
• PII – personal identifiable information
Where TDE act ?

Database Engine
Decrypt

TD
E
Encrypt
What is TDE ?
• One more layer to protect data
• Encrypt at page level on the fly. It means data, log and backup files
are encrypted
• Does not encrypt columns or connections
• Algorithm: AES 128, 192, 256 and Triple DES
Encryption Hierarchy
• Windows level: Data
Protection API (DPAPI)
• SQL Instance level: master key
and certificate
• Database level: database
master key and encryption key
Encryption Hierarchy 2

Windows / OS

SQL Instance

Database
Encryption Hierarchy 3

12
SSMS user
interface
Pros and Cons
PROS CONS
• Encrypt database files: backup, • Does not encrypt memory or
transaction log and data files file streams data
• Protect data against lower- • Does not encrypt connections
level access like OS users • Must be SQL 2008+ enterprise
• Low performance cost or developer edition
• It is transparent, no coding
Other considerations
• Always encrypt TempDB (pro or cons)
• Master key dependency (may use SQL EKM capability or EKM software)
• Works with high availability and disaster recovery options: failover clustering,
mirroring and log shipping
• Replication data is not encrypted when it travels between servers (plain text)
• TDE has an estimated performance impact around 3-5% and can be much
lower if most of the data accessed is stored in memory. The impact will mainly
be on the CPU, I/O will have a smaller impact.
• See the SQL documentation on this topic for more details.SATA + 4200 rpm + 1
GB = 1 min 20 sec.
• SCSI + 15000 rpm + SAN (redundancy disk/Raid 0) will be much faster.
References
• Understanding TDE
https://msdn.microsoft.com/en-us/library/bb934049(v=sql.120).aspx
• Extensible Key Management (EKM)
https://msdn.microsoft.com/en-us/library/bb895340(v=sql.120).aspx
• Protecting SQL Server Data – John Magnabosco
(free ebook from Red Gate)
http://www.amazon.com/Protecting-Server-Data-John-Magnabosco/dp/1
906434271
Questions?

17
Thank You!

© Atlas Systems 2023

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy