SQL Server 2005 Security: Encrypting Data at Rest
Here are some references, for this week's 2780 - Maintaining a Microsoft SQL Server 2005 Database - class on using encryption inside SQL Server 2005:
General Implementation steps (from Improving Data Security by Using SQL Server 2005):
To encrypt data at rest by using SQL Server 2005 symmetric encryption, use the following steps:
1. Create the Database Master Key. SQL Server 2005 uses the Database Master Key to encrypt the private key of the certificate that you create in step 2.
2. Create a certificate. SQL Server 2005 uses certificates to encrypt data or to encrypt symmetric keys. [Remember that while you can use self-signed certificates created by SQL Server for testing, you should only use properly-trusted certificates generated by your organization's certificate authority (CA) - Chris]
3. Create a symmetric key to encrypt the destination data. Encrypt this symmetric key by using the certificate that you created in step 2, by using another symmetric key, or by using a user-supplied password.
4. Open the symmetric key to encrypt or to decrypt data. To open this key, use the same mechanism with which you encrypted the key.
5. Encrypt data by using the EncryptByKey() function, or decrypt data by using the DecryptByKey() function. The data is now stored as a binary large object (BLOB) in the database, or the data is now decrypted, depending on the Transact-SQL statement that you used.
6. Close all symmetric keys.
White Papers:
-
Improving Data Security by Using SQL Server 2005 - Detailed discussion describing how Microsoft IT uses SQL Server 2005 to improve data security for its line of business applications. Includes Whitepaper, presentation and webcast links. Scenario-oriented, with less technical detail than the next one
- Protect Sensitive Data Using Encryption in SQL Server 2005 - This paper explores the encryption features in SQL Server 2005 that you can use to protect your data. More technical detail than the above reference, with a T-SQL syntax reference to encryption-related commands
Demos:
- Laurentiu Cristofor's Simple demo for how to encrypt and decrypt a table column in SQL Server 2005
- Robert Walters's recorded presentation from the SQL PASS 2006 Community Summit. (warning - Windows Media link)
See the topic "How to: Encrypt a Column of Data" in Books Online for more information.
And if it isn't going to cause a recursive loop to link to my own blog, I've also previously posted on SQL Server 2005 - Certificates.




Reader Comments