Download eBook (PDF) - Red Gate Software

More documents

Recommendations

Info

6 – Transparent Data Encryptionand test their ability to access the encrypted data. The use of REVERTterminates the impersonation and returns us to our original user account.USE HomeLending;GO-- execute as a user who is a member of Sensitive_high roleEXECUTE AS USER = 'WOLFBA';GOSELECT * FROM dbo.Borrower;GOREVERT;GO-- execute as a user who is a member of Sensitive_medium roleEXECUTE AS USER = 'KELLEYWB';GOSELECT * FROM dbo.Borrower;GOREVERT;GO-- execute as a user who is a member of Sensitive_low roleEXECUTE AS USER = 'JONESBF';GOSELECT * FROM dbo.Borrower;GOREVERT;GOListing 6-11: Verifying TDE using EXECUTE AS queries.Each query in the above script successfully returns the contents of theBorrower table within the HomeLending database. This demonstrates thatthe automatic decryption is functioning as expected, and verifies thatpermissions to the appropriate database objects are not affected.Please note that if the exercises for implementing cell-level encryption,presented in Chapter 5, have been completed within the same database that isbeing used in the TDE exercises, the query in Listing 6-11 will fail sincepermissions to all tables were denied to the Sensitive_high,Sensitive_medium and Sensitive_low database roles. This can beovercome by granting SELECT permissions to these database roles to theBorrower table.143
6 – Transparent Data EncryptionReversing the Implementation of TDEIt was once said that the only things certain in life are death and taxes. It couldbe argued that change is another certainty. You may find yourself in a situationwhere TDE has been implemented, you have validated that it works, are readyfor users to begin using the newly-encrypted database and then, lo-and-behold,a request to reverse TDE comes your way.Boss: "I would like you to proceed with implementing TDEimmediately …"DBA: "Cool, I'll get right on it."(DBA Implements TDE)Boss: "Hey, as I was saying yesterday: I would like you to proceedwith implementing TDE next week after our presentation to theTechnology Committee."DBA: "No problem … ah …"(Begin reversal process)If, at the time this request comes your way, no transactions have beenperformed on the encrypted database then you can reverse the TDEimplementation using the following steps:1. Restore the backup file of the HomeLending database that wascreated before TDE was implemented.2. Drop the certificate that was created in the Master database. Thisshould only be done if there are no other user databases in the instancethat have been TDE-enabled. If there are other user databases in theinstance that have TDE enabled, you will want to leave the Masterdatabase items untouched.3. Drop the database master key that was created in the Masterdatabase. This should only be done if there are no other user databasesin the instance that have TDE enabled. Otherwise, you will want toleave the Master database items untouched.4. Restart the instance in which the HomeLending database resides. Ifthere are not any other user databases on the instance that have TDEimplemented, this action will force the recreation of the TempDBdatabase in an unencrypted format.Listing 6-12 shows the code to implement these steps.144
Page 1:
High Performance SQL ServerProtecti
Page 4 and 5:
Table of ContentsAbout the Author .
Page 6 and 7:
Protection via Normalization ......
Page 8 and 9:
Views and Stored Procedures .......
Page 10 and 11:
Numeric Variance ..................
Page 12 and 13:
Key_ID ............................
Page 14 and 15:
ACKNOWLEDGEMENTSBooks are not writt
Page 16 and 17:
IntroductionIn all cases, the conse
Page 18 and 19:
Introduction"lost key" displaced by
Page 20 and 21:
CHAPTER 1: UNDERSTANDINGSENSITIVE D
Page 22 and 23:
1 - Understanding Sensitive DataSen
Page 24 and 25:
1 - Understanding Sensitive Datatyp
Page 26 and 27:
1 - Understanding Sensitive DataFor
Page 28 and 29:
1 - Understanding Sensitive DataAcc
Page 30 and 31:
1 - Understanding Sensitive DataThi
Page 32 and 33:
1 - Understanding Sensitive Datarep
Page 34 and 35:
1 - Understanding Sensitive DataThe
Page 36 and 37:
1 - Understanding Sensitive Datathe
Page 38 and 39:
CHAPTER 2: DATACLASSIFICATION AND R
Page 40 and 41:
2 - Data Classification and Rolespr
Page 42 and 43:
2 - Data Classification and RolesDe
Page 44 and 45:
2 - Data Classification and RolesCr
Page 46 and 47:
2 - Data Classification and RolesLi
Page 48 and 49:
2 - Data Classification and Roles--
Page 50 and 51:
2 - Data Classification and RolesAl
Page 52 and 53:
2 - Data Classification and Rolesdo
Page 54 and 55:
2 - Data Classification and RolesTo
Page 56 and 57:
2 - Data Classification and Rolesaf
Page 58 and 59:
2 - Data Classification and RolesTh
Page 60 and 61:
2 - Data Classification and RolesSe
Page 62 and 63:
2 - Data Classification and RolesWi
Page 64 and 65:
3 - Schema Architecture StrategiesF
Page 66 and 67:
3 - Schema Architecture Strategiesp
Page 68 and 69:
3 - Schema Architecture StrategiesN
Page 70 and 71:
3 - Schema Architecture StrategiesA
Page 72 and 73:
3 - Schema Architecture StrategiesD
Page 74 and 75:
3 - Schema Architecture StrategiesU
Page 76 and 77:
3 - Schema Architecture Strategiesb
Page 78 and 79:
3 - Schema Architecture StrategiesU
Page 80 and 81:
3 - Schema Architecture StrategiesF
Page 82 and 83:
3 - Schema Architecture Strategies
Page 84 and 85:
3 - Schema Architecture StrategiesS
Page 86 and 87:
4 - Encryption Basics for SQL Serve
Page 88 and 89:
Page 90 and 91:
Page 92 and 93:
Page 94 and 95: 4 - Encryption Basics for SQL Serve
Page 102 and 103: 5 - Cell-Level Encryptionthe encryp
Page 104 and 105: 5 - Cell-Level EncryptionSearching
Page 106 and 107: 5 - Cell-Level EncryptionPreparing
Page 108 and 109: 5 - Cell-Level EncryptionUSE HomeLe
Page 110 and 111: 5 - Cell-Level Encryptionself-signe
Page 112 and 113: 5 - Cell-Level Encryptionwithin SQL
Page 114 and 115: 5 - Cell-Level EncryptionTesting th
Page 116 and 117: 5 - Cell-Level Encryptioncolumn. Cu
Page 118 and 119: 5 - Cell-Level EncryptionFROMdbo.Bo
Page 120 and 121: 5 - Cell-Level Encryptioncolumn con
Page 122 and 123: 5 - Cell-Level Encryptionthat is a
Page 124 and 125: 5 - Cell-Level EncryptionBEGIN TRY-
Page 126 and 127: 5 - Cell-Level Encryption);)@Identi
Page 128 and 129: 5 - Cell-Level Encryption• The sc
Page 130 and 131: 6 - Transparent Data EncryptionHow
Page 132 and 133: 6 - Transparent Data EncryptionCons
Page 134 and 135: 6 - Transparent Data Encryptionand
Page 136 and 137: 6 - Transparent Data EncryptionNoti
Page 138 and 139: 6 - Transparent Data EncryptionUSE
Page 140 and 141: 6 - Transparent Data EncryptionThe
Page 142 and 143: 6 - Transparent Data EncryptionGONO
Page 146 and 147: 6 - Transparent Data EncryptionUSE
Page 148 and 149: CHAPTER 7: ONE-WAYENCRYPTIONAs a ch
Page 150 and 151: 7 - One-Way EncryptionBenefits and
Page 152 and 153: 7 - One-Way Encryption• A match i
Page 154 and 155: 7 - One-Way EncryptionPlain TextEnd
Page 156 and 157: 7 - One-Way EncryptionReducing Vuln
Page 158 and 159: 7 - One-Way EncryptionUse HomeLendi
Page 160 and 161: 7 - One-Way EncryptionEXEC sp_addex
Page 162 and 163: 7 - One-Way EncryptionLater in this
Page 164 and 165: 7 - One-Way EncryptionUSE HomeLendi
Page 166 and 167: 7 - One-Way EncryptionWHEREBorrower
Page 168 and 169: 7 - One-Way Encryption-- Return Sea
Page 170 and 171: 7 - One-Way EncryptionEXECUTE AS US
Page 172 and 173: CHAPTER 8: OBFUSCATIONHalloween is
Page 174 and 175: 8 - Obfuscation• Artificial Data
Page 176 and 177: 8 - ObfuscationHowever, not all val
Page 178 and 179: 8 - ObfuscationRepeating Character
Page 180 and 181: 8 - ObfuscationASSELECTdbo.Characte
Page 182 and 183: 8 - ObfuscationGO181
Page 184 and 185: 8 - ObfuscationSET Identification_V
Page 186 and 187: 8 - ObfuscationThe Purpose_Type_ID
Page 188 and 189: 8 - ObfuscationArtificial Data Gene
Page 190 and 191: 9 - Honeycombing a DatabaseUse Home
Page 192 and 193: 9 - Honeycombing a DatabaseUSE Mast
Page 194 and 195:
9 - Honeycombing a DatabaseLog Item
Page 196 and 197:
9 - Honeycombing a Databaseto 127.
Page 198 and 199:
9 - Honeycombing a Databaseavailabl
Page 200 and 201:
9 - Honeycombing a DatabaseAvoid SQ
Page 202 and 203:
10 - Layering SolutionsDesign for P
Page 204 and 205:
10 - Layering SolutionsObfuscationU
Page 206 and 207:
10 - Layering SolutionsThe completi
Page 208 and 209:
APPENDIX A: VIEWS ANDFUNCTIONS REFE
Page 210 and 211:
Appendix A - Views and Functions Re
Page 212 and 213:
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
APPENDIX B: THE HOMELENDINGDATABASE
Page 230 and 231:
Appendix B - The HomeLending databa
Page 232:
About Red GateYou know those annoyi
show all

Download eBook (PDF) - Red Gate Software

Create successful ePaper yourself

Delete template?

Save as template?