The Database Security is a very common and one of the major aspects for DBA to keep data secure.
If you don’t know about SQL Server TDE, please read below article which uses for data encryption in SQL Server.

SQL Server: Transparent Data Encryption (TDE) to Encrypt a Database

There are different ways to encrypt your data like TDE, data masking, symmetric key.

In this post, I am sharing a demonstration on how to encrypt your table column using Symmetric key encryption.
For example, When you are storing customer’s credit card information, you must encrypt all cards related columns.

Below is a full demonstration of this:

Create a table with sample data:

CREATE TABLE dbo.tbl_CustomerCards
(
	CustID INT PRIMARY KEY
	,CustName VARCHAR(10)
	,CustCardNo CHAR(8)
)
GO
INSERT INTO dbo.tbl_CustomerCards VALUES
(1,'Anvesh','25-85-96'),(2,'Neevan','88-26-19')
,(3,'Roy','29-30-32'),(4,'Muskan','36-22-69')
,(5,'Martin','26-88-66'),(6,'Jenny','74-21-31')
GO

Create your master key and give password base on windows policy:

CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Dbrnd888';
GO


--If your password does not match windows policy, you will get a below error.
Msg 15118, Level 16, State 1, Line 1
Password validation failed. The password does not meet Windows policy requirements because it is not complex enough.

Create a database certificate which is protected by database master key:

CREATE CERTIFICATE dbrnd_certificate
WITH SUBJECT = 'dbrnd Data';
GO

Create a symmetric key which uses for encryption/decryption:
I used AES_256 algorithm.

CREATE SYMMETRIC KEY dbrnd_Symmetric_key
WITH ALGORITHM = AES_256 
ENCRYPTION BY CERTIFICATE dbrnd_certificate;
GO

Add one more column in a table:

ALTER TABLE tbl_CustomerCards 
ADD CustCardNo_encrypt VARBINARY(MAX) 
GO

Open a symmetric key for further use:

OPEN SYMMETRIC KEY dbrnd_Symmetric_key
DECRYPTION BY CERTIFICATE dbrnd_certificate;
GO

Update newly created column by generating encrypted data with use of old column:

UPDATE tbl_CustomerCards
SET CustCardNo_encrypt = EncryptByKey (Key_GUID('dbrnd_Symmetric_key'),CustCardNo)
FROM tbl_CustomerCards
GO

Now, You can remove your old column:

ALTER TABLE tbl_CustomerCards
DROP COLUMN CustCardNo;
GO

SELECT encrypted/decrypted card numbers:

SELECT CustID, CustCardNo_encrypt AS 'Encrypted_CardNumber',
CONVERT(varchar, DecryptByKey(CustCardNo_encrypt)) AS 'Decrypted_CardNumber'
FROM dbo.tbl_CustomerCards;

Try to Insert few records with encrypted card number values:

INSERT INTO dbo.tbl_CustomerCards VALUES
(7,'Meera',EncryptByKey( Key_GUID('dbrnd_Symmetric_key'), CONVERT(varchar,'66-52-36')))
,(8,'Laria',EncryptByKey( Key_GUID('dbrnd_Symmetric_key'), CONVERT(varchar,'99-36-23')))
GO

Once you complete with the use symmetric key, CLOSE it:

CLOSE SYMMETRIC KEY dbrnd_Symmetric_key;
GO

The result:

What do you mean by Database Security?

Database security refers to the collective measures used to protect and secure a database or database management software from illegitimate use and malicious threats and attacks. It is a broad term that includes a multitude of processes, tools and methodologies that ensure security within a database environment.

What is Data Masking?

Database Theory: What is a Data Masking ?

What is Data Theft?

Data theft is the act of stealing computer-based information from an unknowing victim with the intent of compromising privacy or obtaining confidential information. Data theft is increasingly a problem for individual computer users, as well as big corporate firms.

Data must be stored and transmitted securely, so that information such as credit card numbers cannot be stolen. Over the Internet and Wide Area Network (WAN) environments, both public carriers and private network owners often route portions of their network through insecure landlines, extremely vulnerable microwave and satellite links, or a number of servers.

What are the different types of Security levels?

• Physical
• Human
• Operating System
• Network
• Database System

What does Database Encryption and Decryption mean?

Database encryption is the process of converting data, within a database, in plain text format into a meaningless cipher text by means of a suitable algorithm.

Database decryption is converting the meaningless cipher text into the original information using keys generated by the encryption algorithms.

Database encryption can be provided at the file or column level.

What is SQL injection?

SQL injection is an attack by malicious users in which malicious code can be inserted into strings that can be passed to an instance of SQL server for parsing and execution. All statements have to checked for vulnerabilities as it executes all syntactically valid queries that it receives.

Even parameters can be manipulated by the skilled and experienced attackers.

What are the methods used to protect against SQL injection attack?

Following are the methods used to protect against SQL injection attack:

• Use Parameters for Stored Procedures
• Filtering input parameters
• Use Parameter collection with Dynamic SQL
• In like clause, user escape characters

How can SQL Server instances be hidden?

To hide a SQL Server instance, we need to make a change in SQL Server Configuration Manager.

To do this launch SQL Server Configuration Manager and do the following:

select the instance of SQL Server, right click and select Properties. After selecting properties you will just set Hide Instance to “Yes” and click OK or Apply.

After the change is made, you need to restart the instance of SQL Server to not expose the name of the instance.

What are Orphaned Users?

A database user for which the corresponding SQL Server login is undefined or is incorrectly defined on a server instance cannot log in to the instance. Such a user is said to be an orphaned user of the database on that server instance.

• A database user can become orphaned if the corresponding SQL Server login is dropped.
• A database user can become orphaned after a database is restored or attached to a different instance of SQL Server.
• Orphaning can happen if the database user is mapped to a SID that is not present in the new server instance.

Would you please describe any five server role with its permission?

• bulkadmin: Granted – ADMINISTER BULK OPERATIONS
• dbcreator: Granted – CREATE ANY DATABASE
• diskadmin: Granted – ALTER RESOURCES
• processadmin: Granted – ALTER ANY CONNECTION, ALTER SERVER STATE
• securityadmin: Granted – ALTER ANY LOGIN
• serveradmin: Granted – ALTER ANY ENDPOINT, ALTER RESOURCES, ALTER SERVER STATE, ALTER SETTINGS, SHUTDOWN, VIEW SERVER STATE
• setupadmin: Granted – ALTER ANY LINKED SERVER
• sysadmin: Granted with GRANT option – CONTROL SERVER

Which authentication mode is more secured?

Windows authentication is definitely more secure as it’s controlled and authenticated by Active Directory policies.

What is a Symmetric key in Data encryption process?

In Symmetric cryptography system, the sender and the receiver of a message share a single, common key that is used to encrypt and decrypt the message. This is relatively easy to implement, and both the sender and the receiver can encrypt or decrypt the messages.

What is a Asymmetric key in Data encryption process?

Asymmetric cryptography, also known as Public-key cryptography, is a system in which the sender and the receiver of a message have a pair of cryptographic keys – a public key and a private key – to encrypt and decrypt the message. This is a relatively complex system where the sender can use his key to encrypt the message but he cannot decrypt it. The receiver, on the other hand, can use his key to decrypt the message but he cannot encrypt it.

What Secure Socket Layer (SSL) with SQL Server and can we enable it?

Yes: We can enable SSL with SQL Server

Microsoft SQL Server can use Secure Sockets Layer (SSL) to encrypt data that is transmitted across a network between an instance of SQL Server and a client application. Enabling SSL encryption increases the security of data transmitted across networks between instances of SQL Server and applications.

What are basic steps to configure SSL for SQL Server?

Install a certificate in the Windows certificate store of the server computer.

Click Start, in the Microsoft SQL Server program group, point to Configuration Tools, and thenclick SQL Server Configuration Manager.

Expand SQL Server Network Configuration, right-click the protocols for the server you want, and then click Properties.

On the Certificate tab, configure the Database Engine to use the certificate.

On the Flags tab, view or specify the protocol encryption option. The login packet will always be encrypted.

What are the built-In Schemas?

• dbo
• guest
• sys
• INFORMATION_SCHEMA

Are you agree with User-Schema Separation in SQL Server?

Yes: User-schema separation allows for more flexibility in managing database object permissions. A schema is a named container for database objects, which allows you to group objects into separate namespaces.

What do you know about the Universally Unique Identifier – UUID data type?

Database Theory: The truth about Universally Unique Identifier – UUID

When we are declaring a variable using SET or SELECT, What is the performance different between SET and SELECT?

SQL Server: Truth about assigning variables using SET versus SELECT

What is the purpose of OPENXML clause SQL server stored procedure?

OPENXML parses the XML data in SQL Server in an efficient manner. It’s primary ability is to insert XML data to the RDB. It is also possible to query the data by using OpenXML. The path of the XML element needs to be specified by using ‘xpath’.

What is the use of @@CPU_BUSY statement?

It returns the time that SQL Server has spent working since it was last started.

Explain the use of keyword WITH ENCRYPTION. Create a Store Procedure with Encryption.

WITH ENCRYPTION indicates that SQL Server will convert the original text of CREATE PROCEDURE statement to an encrypted format. Users that do not have no access to system tables or database files cannot retrieve the encrypted text. However, the text will be available to privileged users.

If you need to script a table with data, how will you do that?

One way to achieve this by using  Generate Script Task in SSMS.

Right click on database and then go to Tasks and then go to Generate Scripts.

I have two tables with the same columns and data types. If I need toget distinct records from both of tables how can I do that?

We can use the UNION operators.

Can we send emails in HTML Format from SQL Server, How will you do that?

We can send email from SQL Server in HTML format by using dbo.sp_send_dbmail stored procedure. To send email in HTML format, we have to build the body of email with HTML Tags. The below code can be used to send basis HTML formatted email. If you want to loop through some results of table and send in HTML formatted email.

Can we create triggers on temp table?

No: we cannot create a trigger on temp table.

How would you get the size of a SQL Server Table?

EXEC sp_spaceused ‘TableName’

How would you determine if the expression is Numeric?

ISNUMERIC( ): function is provided to us in SQL Server to check if the expression is valid numeric type or not. As per Microsoft it should work with Integers and Decimal data types and if data is valid integer or decimal, ISNumeric() should return us 1 else 0.

Try_Convert( ): In SQL Server 2012. Microsoft introduced new function call Try_Convert( ). You can use try_convert function to convert to required data type and if it is not able to convert then it will return Null as output.

Which function is used to convert the integer value into spaces?

The SPACE function converts the specified integer value into spaces.

SELECT SPACE(8);

What is constant folding?

SQL Server evaluates some constant expression early to improve the query performance. This is called constant folding.

What is a full text search in SQL Server?

Full text indexing is a great feature that solves a database problem, the searching of textual data columns for specific words and phrases in SQL Server databases.

Full Text Index can be used to search words, phrases and multiple forms of a word or phrase using FREETEXT () and CANTAINS () with “and” or “or” operators.

Can you execute full-text queries on a table without full-text index on that column?

No: Before you can run full-text queries on a table, the database administrator must create a full-text index on the table. The full-text index includes one or more character-based columns in the table. These columns can have any of the following data types: char, varchar, nchar, nvarchar, text, ntext, image, xml, or varbinary(max) and FILESTREAM.

Are Full-text queries are case-sensitive?

Full-text queries are not case-sensitive. For example, searching for “DBRND” or “dbrnd” returns the same results.

What is the difference between LIKE and FULL-Text Search?

In contrast to full-text search, the LIKETransact-SQL predicate works on character patterns only. Also, you cannot use the LIKE predicate to query formatted binary data. Furthermore, a LIKE query against a large amount of unstructured text data is much slower than an equivalent full-text query against the same data.

A LIKE query against millions of rows of text data can take minutes to return; whereas a full-text query can take only seconds or less against the same data, depending on the number of rows that are returned.

What is a Full-Text Engine?

The Full-Text Engine in SQL Server is fully integrated with the query processor. The Full-Text Engine compiles and executes full-text queries. As part of query execution, the Full-Text Engine might receive input from the thesaurus and stoplist.

What is the internal process of Full-Text Querying?

• The query processor passes the full-text portions of a query to the Full-Text Engine for processing. The Full-Text Engine performs word breaking and, optionally, thesaurus expansions, stemming, and stopword (noise-word) processing.
• Then the full-text portions of the query are represented in the form of SQL operators, primarily as streaming table-valued functions (STVFs).
• During query execution, these STVFs access the inverted index to retrieve the correct results. The results are either returned to the client at this point, or they are further processed before being returned to the client.

What is CONTAINS and FREETEXT of Full-Text predicates?

The CONTAINS and FREETEXT predicates return a TRUE or FALSE value. They can be used only to specify selection criteria for determining whether a given row matches the full-text query. Matching rows are returned in the result set. CONTAINS and FREETEXT are specified in the WHERE or HAVING clause of a SELECT statement. They can be combined with any of the other Transact-SQL predicates, such as LIKE and BETWEEN.

When using CONTAINS or FREETEXT, you can specify either a single column, a list of columns, or all columns in the table to be searched.

What it is not recommended to name the user defined Stored Procedures with sp_?

They are system defined and mostly resides under the master database so if we write a user defined stored procedure by the name sp_ the query engine will first search the Stored Procedure in the master database and if not found then it will search in the current session database.

This brings unnecessary round trip and reduce the overall performance of user defined stored procedures.

Can we use the PRINT statement in SQL Server Function?

No: We cannot use it.

If you are working on a SQL database and if suddenly a developer changes the code and your queries results start giving errors, how will you check using a T-SQL query (on system tables) that what has changed in the database.

select o.name, o.object_id, o.modify_date, c.text
from sys.objects o
join sys.syscomments c
on o.object_id = c.id

SQL Server 2008 introduced Transparent Data Encryption (TDE) technique to encrypt the different database files like data file, log file and backup file.

As a Database Professionals, we are also responsible for all kinds of data and database security.

You can find an N number of similar TDE theory over the internet, but still, I would like to write an underlying note about what is TDE and why it is important.

Any underlying encryption algorithm brings your data into a state that cannot be interpreted by anyone without applying a decryption key, password or certificates.

As a DBA, we have to also maintain the decryption key, password and certificates information backup because once we lost this information, we cannot decrypt the encrypted data or database.

TDE uses for bulk encryption at the different type of database files.
You can enable TDE at the database level, and once we enabled, it encrypts all data into the pages before it writes to the disk and it decrypts when reading from the disk.

Once you enable TDE on a database, you do not require any other application code to manage encryption and decryption of the data so that you can use this feature without changing a single line of application code.

TDE uses the AES and 3DES encryption algorithms, and the encryption and decryption operations are run on background threads by SQL Server and database backup also encrypted by TDE.

TDE only encrypts the data before writing to the disk, so there is also another different state where TDE is not applying encryption.

When you are sending and transferring your data between SQL Server and other application, the TDE doesn’t apply any encryption.

Before writing to the disk, data is coming from buffer pool and into this buffer pool area data is available in the plain text format, so TDE doesn’t apply any encryption in this buffer pool.

The performance overhead is involved in using TDE. The encryption and decryption process does require additional CPU cycles. The cost for using TDE ranges from about 3 percent to 30 percent, depending on the type of workload.

SQL Server instances with low I/O and low CPU usage will have the least performance impact. Servers with high CPU usage will have the most performance impact.

In the next post, You can find require T-SQL scripts and steps to enable TDE on the SQL Server Database.

This is going to be one of the most important article for the PostgreSQL community because I am going to share, what should be our best practice to store encrypted passwords into PostgreSQL Database Server.

I am sharing some of the important pgcrypto’s cryptographic functions for PostgreSQL password encryption.

Generally, people are using MD5 and SHA algorithm for password encryption, but both are easy to break and vulnerable, so we should not use this in our general practice.

The PostgreSQL provides pgcrypto module or extension with the set of cryptography functions.

First, We need to install the pgcrypto extension in PostgreSQL.

CREATE EXTENSION pgcrypto;

Below is a list of hashing algorithm along with its require bit size.

• MD5 = 128-bit hash value.
• SHA1 = 160-bit hash value.
• SHA224 = 224-bit hash value.
• SHA256 = 256-bit hash value.
• SHA384 = 384-bit hash value.
• SHA512 = 512-bit hash value.

Other Important Hashing Functions:

digest() :
It computes a binary hash of the given data. It supports all standard algorithms like: md5, sha1, sha224, sha256, sha384 and sha512.
We can use ENCODE() to convert a binary string into hexadecimal.

SELECT ENCODE(DIGEST('AnveshPassword','md5'),'hex');
SELECT ENCODE(DIGEST('AnveshPassword','sha1'),'hex');
SELECT ENCODE(DIGEST('AnveshPassword','sha224'),'hex');
SELECT ENCODE(DIGEST('AnveshPassword','sha256'),'hex');
SELECT ENCODE(DIGEST('AnveshPassword','sha384'),'hex');
SELECT ENCODE(DIGEST('AnveshPassword','sha512'),'hex');

hmac() :
It calculates hashed MAC for data with the key. This is similar to digest(), but more secure because it requires the key.We can use ENCODE() to convert a binary string into hexadecimal.

SELECT ENCODE(HMAC('AnveshPassword','mykey','md5'),'hex');
SELECT ENCODE(HMAC('AnveshPassword','mykey','sha1'),'hex');
SELECT ENCODE(HMAC('AnveshPassword','mykey','sha224'),'hex');
SELECT ENCODE(HMAC('AnveshPassword','mykey','sha256'),'hex');
SELECT ENCODE(HMAC('AnveshPassword','mykey','sha384'),'hex');
SELECT ENCODE(HMAC('AnveshPassword','mykey','sha512'),'hex');

crypt() and gen_salt() :
This is more secure than any other cryptographic functions.
This is specially designed for hashing passwords.
crypt() does the hashing and gen_salt() prepare algorithm parameters for it.

Generally, when we are using another algorithm like md5(), it generates the same string for same password text.

The most important point is, it generates a random string even for same password text.

Supported algorightms for crypt():
Reference taken from the PostgreSQL official document.

Below is a small demonstration of this:

Create a sample table:

CREATE TABLE tbl_TestPassword (MyPassword TEXT);

Insert a sample encrypted passwords:

INSERT INTO tbl_TestPassword VALUES (CRYPT('AnveshPassword', GEN_SALT('md5')));
INSERT INTO tbl_TestPassword VALUES (CRYPT('AnveshPassword', GEN_SALT('md5')));
INSERT INTO tbl_TestPassword VALUES (CRYPT('MyNewPassword', GEN_SALT('md5')));

Check the result and identify different string for even a same password:

SELECT *FROM tbl_TestPassword;

Check and authenticate given password:

SELECT *FROM tbl_TestPassword WHERE MyPassword = (CRYPT('AnveshPassword', MyPassword));

-- It returns two records.

SELECT *FROM tbl_TestPassword WHERE MyPassword = (CRYPT('MyNewPassword', MyPassword));

-- It returns one record.