The Database Security is a very common and one of the major aspects for DBA to keep data secure.
If you don’t know about SQL Server TDE, please read below article which uses for data encryption in SQL Server.

SQL Server: Transparent Data Encryption (TDE) to Encrypt a Database

There are different ways to encrypt your data like TDE, data masking, symmetric key.

In this post, I am sharing a demonstration on how to encrypt your table column using Symmetric key encryption.
For example, When you are storing customer’s credit card information, you must encrypt all cards related columns.

Below is a full demonstration of this:

Create a table with sample data:

CREATE TABLE dbo.tbl_CustomerCards
(
	CustID INT PRIMARY KEY
	,CustName VARCHAR(10)
	,CustCardNo CHAR(8)
)
GO
INSERT INTO dbo.tbl_CustomerCards VALUES
(1,'Anvesh','25-85-96'),(2,'Neevan','88-26-19')
,(3,'Roy','29-30-32'),(4,'Muskan','36-22-69')
,(5,'Martin','26-88-66'),(6,'Jenny','74-21-31')
GO

Create your master key and give password base on windows policy:

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Dbrnd888';
GO


--If your password does not match windows policy, you will get a below error.
Msg 15118, Level 16, State 1, Line 1
Password validation failed. The password does not meet Windows policy requirements because it is not complex enough.

Create a database certificate which is protected by database master key:

CREATE CERTIFICATE dbrnd_certificate
WITH SUBJECT = 'dbrnd Data';
GO

Create a symmetric key which uses for encryption/decryption:
I used AES_256 algorithm.

CREATE SYMMETRIC KEY dbrnd_Symmetric_key
WITH ALGORITHM = AES_256 
ENCRYPTION BY CERTIFICATE dbrnd_certificate;
GO

Add one more column in a table:

ALTER TABLE tbl_CustomerCards 
ADD CustCardNo_encrypt VARBINARY(MAX) 
GO

Open a symmetric key for further use:

OPEN SYMMETRIC KEY dbrnd_Symmetric_key
DECRYPTION BY CERTIFICATE dbrnd_certificate;
GO

Update newly created column by generating encrypted data with use of old column:

UPDATE tbl_CustomerCards
SET CustCardNo_encrypt = EncryptByKey (Key_GUID('dbrnd_Symmetric_key'),CustCardNo)
FROM tbl_CustomerCards
GO

Now, You can remove your old column:

ALTER TABLE tbl_CustomerCards
DROP COLUMN CustCardNo;
GO

SELECT encrypted/decrypted card numbers:

SELECT CustID, CustCardNo_encrypt AS 'Encrypted_CardNumber',
CONVERT(varchar, DecryptByKey(CustCardNo_encrypt)) AS 'Decrypted_CardNumber'
FROM dbo.tbl_CustomerCards;

Try to Insert few records with encrypted card number values:

INSERT INTO dbo.tbl_CustomerCards VALUES
(7,'Meera',EncryptByKey( Key_GUID('dbrnd_Symmetric_key'), CONVERT(varchar,'66-52-36')))
,(8,'Laria',EncryptByKey( Key_GUID('dbrnd_Symmetric_key'), CONVERT(varchar,'99-36-23')))
GO

Once you complete with the use symmetric key, CLOSE it:

CLOSE SYMMETRIC KEY dbrnd_Symmetric_key;
GO

The result:

What do you mean by Database Security?

Database security refers to the collective measures used to protect and secure a database or database management software from illegitimate use and malicious threats and attacks. It is a broad term that includes a multitude of processes, tools and methodologies that ensure security within a database environment.

What is Data Masking?

Database Theory: What is a Data Masking ?

What is Data Theft?

Data theft is the act of stealing computer-based information from an unknowing victim with the intent of compromising privacy or obtaining confidential information. Data theft is increasingly a problem for individual computer users, as well as big corporate firms.

Data must be stored and transmitted securely, so that information such as credit card numbers cannot be stolen. Over the Internet and Wide Area Network (WAN) environments, both public carriers and private network owners often route portions of their network through insecure landlines, extremely vulnerable microwave and satellite links, or a number of servers.

What are the different types of Security levels?

• Physical
• Human
• Operating System
• Network
• Database System

What does Database Encryption and Decryption mean?

Database encryption is the process of converting data, within a database, in plain text format into a meaningless cipher text by means of a suitable algorithm.

Database decryption is converting the meaningless cipher text into the original information using keys generated by the encryption algorithms.

Database encryption can be provided at the file or column level.

What is SQL injection?

SQL injection is an attack by malicious users in which malicious code can be inserted into strings that can be passed to an instance of SQL server for parsing and execution. All statements have to checked for vulnerabilities as it executes all syntactically valid queries that it receives.

Even parameters can be manipulated by the skilled and experienced attackers.

What are the methods used to protect against SQL injection attack?

Following are the methods used to protect against SQL injection attack:

• Use Parameters for Stored Procedures
• Filtering input parameters
• Use Parameter collection with Dynamic SQL
• In like clause, user escape characters

How can SQL Server instances be hidden?

To hide a SQL Server instance, we need to make a change in SQL Server Configuration Manager.

To do this launch SQL Server Configuration Manager and do the following:

select the instance of SQL Server, right click and select Properties. After selecting properties you will just set Hide Instance to “Yes” and click OK or Apply.

After the change is made, you need to restart the instance of SQL Server to not expose the name of the instance.

What are Orphaned Users?

A database user for which the corresponding SQL Server login is undefined or is incorrectly defined on a server instance cannot log in to the instance. Such a user is said to be an orphaned user of the database on that server instance.

• A database user can become orphaned if the corresponding SQL Server login is dropped.
• A database user can become orphaned after a database is restored or attached to a different instance of SQL Server.
• Orphaning can happen if the database user is mapped to a SID that is not present in the new server instance.

Would you please describe any five server role with its permission?

• bulkadmin: Granted – ADMINISTER BULK OPERATIONS
• dbcreator: Granted – CREATE ANY DATABASE
• diskadmin: Granted – ALTER RESOURCES
• processadmin: Granted – ALTER ANY CONNECTION, ALTER SERVER STATE
• securityadmin: Granted – ALTER ANY LOGIN
• serveradmin: Granted – ALTER ANY ENDPOINT, ALTER RESOURCES, ALTER SERVER STATE, ALTER SETTINGS, SHUTDOWN, VIEW SERVER STATE
• setupadmin: Granted – ALTER ANY LINKED SERVER
• sysadmin: Granted with GRANT option – CONTROL SERVER

Which authentication mode is more secured?

Windows authentication is definitely more secure as it’s controlled and authenticated by Active Directory policies.

What is a Symmetric key in Data encryption process?

In Symmetric cryptography system, the sender and the receiver of a message share a single, common key that is used to encrypt and decrypt the message. This is relatively easy to implement, and both the sender and the receiver can encrypt or decrypt the messages.

What is a Asymmetric key in Data encryption process?

Asymmetric cryptography, also known as Public-key cryptography, is a system in which the sender and the receiver of a message have a pair of cryptographic keys – a public key and a private key – to encrypt and decrypt the message. This is a relatively complex system where the sender can use his key to encrypt the message but he cannot decrypt it. The receiver, on the other hand, can use his key to decrypt the message but he cannot encrypt it.

What Secure Socket Layer (SSL) with SQL Server and can we enable it?

Yes: We can enable SSL with SQL Server

Microsoft SQL Server can use Secure Sockets Layer (SSL) to encrypt data that is transmitted across a network between an instance of SQL Server and a client application. Enabling SSL encryption increases the security of data transmitted across networks between instances of SQL Server and applications.

What are basic steps to configure SSL for SQL Server?

Install a certificate in the Windows certificate store of the server computer.

Click Start, in the Microsoft SQL Server program group, point to Configuration Tools, and thenclick SQL Server Configuration Manager.

Expand SQL Server Network Configuration, right-click the protocols for the server you want, and then click Properties.

On the Certificate tab, configure the Database Engine to use the certificate.

On the Flags tab, view or specify the protocol encryption option. The login packet will always be encrypted.

What are the built-In Schemas?

• dbo
• guest
• sys
• INFORMATION_SCHEMA

Are you agree with User-Schema Separation in SQL Server?

Yes: User-schema separation allows for more flexibility in managing database object permissions. A schema is a named container for database objects, which allows you to group objects into separate namespaces.

SQL Server 2008 introduced Transparent Data Encryption (TDE) technique to encrypt the different database files like data file, log file and backup file.

As a Database Professionals, we are also responsible for all kinds of data and database security.

You can find an N number of similar TDE theory over the internet, but still, I would like to write an underlying note about what is TDE and why it is important.

Any underlying encryption algorithm brings your data into a state that cannot be interpreted by anyone without applying a decryption key, password or certificates.

As a DBA, we have to also maintain the decryption key, password and certificates information backup because once we lost this information, we cannot decrypt the encrypted data or database.

TDE uses for bulk encryption at the different type of database files.
You can enable TDE at the database level, and once we enabled, it encrypts all data into the pages before it writes to the disk and it decrypts when reading from the disk.

Once you enable TDE on a database, you do not require any other application code to manage encryption and decryption of the data so that you can use this feature without changing a single line of application code.

TDE uses the AES and 3DES encryption algorithms, and the encryption and decryption operations are run on background threads by SQL Server and database backup also encrypted by TDE.

TDE only encrypts the data before writing to the disk, so there is also another different state where TDE is not applying encryption.

When you are sending and transferring your data between SQL Server and other application, the TDE doesn’t apply any encryption.

Before writing to the disk, data is coming from buffer pool and into this buffer pool area data is available in the plain text format, so TDE doesn’t apply any encryption in this buffer pool.

The performance overhead is involved in using TDE. The encryption and decryption process does require additional CPU cycles. The cost for using TDE ranges from about 3 percent to 30 percent, depending on the type of workload.

SQL Server instances with low I/O and low CPU usage will have the least performance impact. Servers with high CPU usage will have the most performance impact.

In the next post, You can find require T-SQL scripts and steps to enable TDE on the SQL Server Database.