Pro Encryption in SQL Server 2022: Provide the Highest Level of Protection for Your Data

by Matthew McGiffen

Overview

This in-depth look at the encryption tools available in SQL Server shows you how to protect data by encrypting it at rest with Transparent Data Encryption (TDE) and in transit with Transport Level Security (TLS). You will know how to add the highest levels of protection for sensitive data using Always Encrypted to encrypt data also in memory and be protected even from users with the highest levels of access to the database. The book demonstrates actions you can take today to start protecting your data without changing any code in your applications, and the steps you can subsequently take to modify your applications to support implementing a gold standard in data protection.

The book highlights work that Microsoft has been doing since 2016 to make encryption more accessible, by making TDE available in the standard edition, and the introduction of Always Encrypted that requires minimal work on your part to implement powerful and effective encryption, protecting your dataand meeting regulatory requirements. The book teaches you how to work with the encryption technologies in SQL Server with the express goal of helping you understand those technologies on an intuitive level. You’ll come away with a deep level of understanding that allows you to answer questions and speak as an expert. The book’s aim is to make you as comfortable in deploying encryption in SQL Server as you would be in driving your car to buy groceries.

Those with a data security mindset will appreciate the discussion of how each feature protects you and what it protects you from, as well as how to implement things in the most secure manner. Database administrators will appreciate the high level of detail around managing encryption over time and the effect of encryption on database performance. All readers will appreciate the advice on how to avoid common pitfalls, ensuring that your projects to implement encryption run smoothly.

What You Will Learn

• Architect an effective encryption strategy for new applications
• Retrofit encryption into your existing applications
• Encrypt data at rest, in memory, and in transit
• Manage key and certificate life cycles, including backup and restore
• Recover encrypted databases in case of server failure
• Work with encryption in cloud-based scenarios

Who This Book Is For

Database developers, architects, and administrators who want to work with encryption in SQL Server; those who want to maintain encryption whether data is at rest or being transmitted over the network; and those who wish to encrypt their data even when in the server’s own memory. Readers should be familiar with SQL Server, but no existing knowledge of encryption is assumed.

Product Details

ISBN-13:	9781484286630
Publisher:	Apress
Publication date:	11/18/2022
Edition description:	1st ed.
Pages:	351
Product dimensions:	7.01(w) x 10.00(h) x (d)

About the Author

Matthew McGiffen is a Data Architect with over 20 years’ experience working on SQL Server and associated technologies. Matthew has also had the opportunity to collaborate with Microsoft during the development of some of the latest enhancements in encryption. He is the author of a popular blog on SQL Server and has written articles for SQL Server Central. In his spare time, Matthew is an amateur chess player and pianist.

Table of Contents

Introduction.- Part I. Understanding the Landscape.- 1. Purpose of Encryption and Available Tools.- Part II. Transparent Data Encryption (TDE).- 2. Introducing Transparent Data Encryption.- 3. Setting Up TDE.- 4. Managing TDE.- 5. Backup Encryption.- Part III. Always Encrypted.- 6. What Is Always Encrypted?.- 7. Setting Up Always Encrypted.- 8. Executing Queries Using Always Encrypted.- 9. Encrypting Existing Data with Always Encrypted.- 10. Limitations with Always Encrypted.- 11. Key Rotation with Always Encrypted.- 12. Considerations When Implementing Always Encrypted.- Part IV. Always Encrypted with Enclaves.- 13. Introducing Always Encrypted With Enclaves.- 14. Setting Up Always Encrypted With Enclaves.- 15. In-Place Encryption With Always Encrypted.- Part V. Completing the Picture.- 16. Rich Querying With Always Encrypted Enclaves.- 17. Setting Up TPM Attestation.- 18. Encryption In Transit Using Transport Level Security.- 19. Hashing and Salting of Passwords.- 20. Extensible Key Management (EKM) .- Appendixes.- A. Glossary of Terms.- B. Encryption in the Cloud.- C. Encryption Algorithms.