The Database Security is a very common and one of the major aspects for DBA to keep data secure.
If you don’t know about SQL Server TDE, please read below article which uses for data encryption in SQL Server.

SQL Server: Transparent Data Encryption (TDE) to Encrypt a Database

There are different ways to encrypt your data like TDE, data masking, symmetric key.

In this post, I am sharing a demonstration on how to encrypt your table column using Symmetric key encryption.
For example, When you are storing customer’s credit card information, you must encrypt all cards related columns.

Below is a full demonstration of this:

Create a table with sample data:

CREATE TABLE dbo.tbl_CustomerCards
(
	CustID INT PRIMARY KEY
	,CustName VARCHAR(10)
	,CustCardNo CHAR(8)
)
GO
INSERT INTO dbo.tbl_CustomerCards VALUES
(1,'Anvesh','25-85-96'),(2,'Neevan','88-26-19')
,(3,'Roy','29-30-32'),(4,'Muskan','36-22-69')
,(5,'Martin','26-88-66'),(6,'Jenny','74-21-31')
GO

Create your master key and give password base on windows policy:

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Dbrnd888';
GO


--If your password does not match windows policy, you will get a below error.
Msg 15118, Level 16, State 1, Line 1
Password validation failed. The password does not meet Windows policy requirements because it is not complex enough.

Create a database certificate which is protected by database master key:

CREATE CERTIFICATE dbrnd_certificate
WITH SUBJECT = 'dbrnd Data';
GO

Create a symmetric key which uses for encryption/decryption:
I used AES_256 algorithm.

CREATE SYMMETRIC KEY dbrnd_Symmetric_key
WITH ALGORITHM = AES_256 
ENCRYPTION BY CERTIFICATE dbrnd_certificate;
GO

Add one more column in a table:

ALTER TABLE tbl_CustomerCards 
ADD CustCardNo_encrypt VARBINARY(MAX) 
GO

Open a symmetric key for further use:

OPEN SYMMETRIC KEY dbrnd_Symmetric_key
DECRYPTION BY CERTIFICATE dbrnd_certificate;
GO

Update newly created column by generating encrypted data with use of old column:

UPDATE tbl_CustomerCards
SET CustCardNo_encrypt = EncryptByKey (Key_GUID('dbrnd_Symmetric_key'),CustCardNo)
FROM tbl_CustomerCards
GO

Now, You can remove your old column:

ALTER TABLE tbl_CustomerCards
DROP COLUMN CustCardNo;
GO

SELECT encrypted/decrypted card numbers:

SELECT CustID, CustCardNo_encrypt AS 'Encrypted_CardNumber',
CONVERT(varchar, DecryptByKey(CustCardNo_encrypt)) AS 'Decrypted_CardNumber'
FROM dbo.tbl_CustomerCards;

Try to Insert few records with encrypted card number values:

INSERT INTO dbo.tbl_CustomerCards VALUES
(7,'Meera',EncryptByKey( Key_GUID('dbrnd_Symmetric_key'), CONVERT(varchar,'66-52-36')))
,(8,'Laria',EncryptByKey( Key_GUID('dbrnd_Symmetric_key'), CONVERT(varchar,'99-36-23')))
GO

Once you complete with the use symmetric key, CLOSE it:

CLOSE SYMMETRIC KEY dbrnd_Symmetric_key;
GO

The result:

This is going to be one of most important article for the MySQL community because I am going to share, what should be our best practice to store encrypted passwords into MySQL Database Server.

The MySQL provides different algorithm and function to encrypt and decrypt password data or any other sensitive information so that no one can access it in plain text format.

For different Encryption and Compression functions you can visit this MySQL Developer official site.

Generally, people are using MD5 and SHA algorithm for password encryption, but both are easy to break and vulnerable, so we should not use this in our general practice.

We should also not use PASSWORD() function because it is used by the authentication system in MySQL Server.

Advanced Encryption Standard Algorithm (AES):

This is one of the important encryption algorithm and it is highly secure because it encrypts the string using the encryption key string and returns an encrypted binary string output.

MySQL provides AES_ENCRYPT() to encrypt the string in binary format and AES_DECRYPT() to decrypt the string in plain text.

The only one problem is, we should hide the key value for security purpose by setting object level permission or we can create a view to hide the encryption key value.

You can create BINARY or BLOB data type to store AES encrypted password.

Below is a small demonstration on this:

The syntax:

AES_ENCRYPT(str,key_str)
AES_DECRYPT(crypt_str,key_str)

First, create a table with sample data:

CREATE TABLE tbl_AESPassword
(
    ID INTEGER
    ,UserPassword BLOB
);

INSERT INTO tbl_AESPassword 
VALUES 
(1,AES_ENCRYPT('Anvesh','8'))
,(2,AES_ENCRYPT('Patel','88'));

SELECT first row by comparing password using defined encryption key:

SELECT *	
FROM tbl_AESPassword
WHERE UserPassword = AES_ENCRYPT('Anvesh','8')

-- Result: Returned only first record. 
ID      |  UserPassword
---------------------------
1       | BLOB

To DECRYPT the password into plain text:

mysql> SELECT AES_DECRYPT(AES_ENCRYPT('Anvesh','8'),'8');

+--------------------------------------------+
| AES_DECRYPT(AES_ENCRYPT('Anvesh','8'),'8') |
+--------------------------------------------+
| Anvesh                                     |
+--------------------------------------------+
1 row in set (0.00 sec)

What is TDE (Transparent Data Encryption) method in SQL Server?

SQL Server: Transparent Data Encryption (TDE) to Encrypt a Database

TDE provides the ability to encrypt an entire database and to have the encryption be completely transparent to the applications that access the database. TDE encrypts the data stored in both the database’s data file (.mdf) and log file (.ldf) using either Advanced Encryption Standard (AES) or Triple DES (3DES) encryption.

In addition, any backups of the database are encrypted. This protects the data while it’s at rest as well as provides protection against losing sensitive information if the backup media were lost or stolen.

Which versions of SQL Server support TDE?

TDE requires SQL Server 2012 Enterprise edition.

TDE is also available in SQL Server 2008 and SQL Server 2008 R2 Datacenter and Enterprise editions.

Is there a performance impact for using TDE?

Yes, some performance overhead is involved in using TDE. The encryption and decryption process do require additional CPU cycles. The overhead for using TDE ranges from about 3 percent to 30 percent, depending on the type of workload.

How can you enable TDE in SQL server?

• Create a master key for the database.
• Create a certificate that’s protected by the master key.
• Create a special key that’s used to protect the database. This key is called the database encryption key (DEK) and you secure it using the certificate.
• Enable encryption.

SQL Server: How to enable Transparent Data Encryption (TDE) on a Database?

What is a MASTER KEY?

A master key is a symmetric key that is used to create certificates and asymmetric keys.

What are the Advantages of using TDE?

• Performs real-time I/O encryption and decryption of the data and log files
• Encrypts the Entire Database in rest
• No architectural changes needed
• No application code changes are required and the user experience is the same
• Easy to implement
• DBAs can still see the data

What are the Disadvantages of using TDE?

• Not granular – Cannot just encrypt specific tables/columns
• Not good for high CPU bottleneck servers
• Not protected through communication/networks

Which key provides the strongest encryption?

AES (256 bit)

The longer the key, the better the encryption, so choose longer keys for more encryption. However there is a larger performance penalty for longer keys. DES is a relatively old and weaker algorithm than AES.

AES: Advanced Encryption Standard

DES: Data Encryption Standard

Does TDE prevent the security administrator or database administrator from seeing the data in the database?

No. TDE protects the data at rest, but an authorized user such as a security administrator or a database administrator can access the data in a TDE-encrypted database. To prevent an SA or DBA from accessing selected parts of the data, you need to use application-level encryption.

How do you enable TDE?

To use TDE, first you need to create a master key using the CREATE MASTER KEY T-SQL statement. Next, you need to create a certificate using the CREATE CERTIFICATE command.

Then you need to use the CREATE DATABASE ENCRYPTION KEY statement to encrypt the Database Encryption Key (DEK).  Finally, you need to use the ALTERDATABASE SET ENCRYPTION ON statement to actually encrypt the user database with the DEK. As soon as you use TDE for a user database, TempDB is automatically encrypted as well.

Is there a performance impact for using TDE?

Yes, some performance overhead is involved in using TDE. The encryption and decryption process do require additional CPU cycles. The overhead for using TDE ranges from about 3 percent to 30 percent, depending on the type of workload.

SQL Server instances with low I/O and low CPU usage will have the least performance impact. Servers with high CPU usage will have the most performance impact.

Does TDE encrypt the data stream sent to the client?

No. TDE encrypts the data stored on disk at the page and log level. The data that’s sent across the wire to the client connections isn’t encrypted.

What is the use of db_owner role?

Users in the db_owner role have it all, within a single database. They can grant and revoke access, create tables, stored procedures, views, run backups and schedule jobs. A user who is db_owner can even drop the database.

Why Use db_datareader role?

Let’s say the Accounting department has a separate database. Everyone in Accounting is able to create and run ad hoc reports directly against this database, but they shouldn’t be able to do anything else apart from seeing the contents of the database. Clearly granting db_owner access is out of the question.

Your junior DBA is out sick today, so you can’t make him grant SELECT permissions to every table in the database while you go out for lunch. Instead, you can simply grant db_datareader access to the Accounting department’s Windows group.

What is the use of db_ddladmin role?

Members of the db_ddladmin role are able to execute DDL commands (CREATE, ALTER, DROP) within the current database. It’s pretty self-explanatory – a member of db_ddladmin can run any CREATE, ALTER or DROP command within the current database. They cannot create new databases, nor can they alter or drop the current database.

Creating custom database application role, is bad practice or good practice?

It is good practice.

Granting permissions to roles rather than to users simplifies security administration. Permission sets that are assigned to roles are inherited by all members of the role. It is easier to add or remove users from a role than it is to recreate separate permission sets for individual users.

What kind of different encryption algorithms supported by SQL Server?

SQL Server supports several symmetric key encryption algorithms, including DES, Triple DES, RC2, RC4, 128-bit RC4, DESX, 128-bit AES, 192-bit AES, and 256-bit AES. The algorithms are implemented using the Windows Crypto API.