Download eBook (PDF) - Red Gate Software

1 – Understanding Sensitive Datatransit. For example, SQL Server 2008 offers a feature called Transparent DataEncryption (TDE). This feature encrypts the physical files of a database, itstransaction logs and back up files. When data that is encrypted with TDE isqueried it is decrypted and stored in the memory cache as plain text. There arecritics of this feature who may view this as a flaw in its design; but when youconsider that the scope of this feature was to fulfill the requirements ofprotecting data at rest, and not data in transit, you realize that this feature isextremely effective, and is not intended to be the silver bullet for all datasecurity concerns. More details in regard to the Transparent Data Encryptionfeature of SQL Server 2008 will be covered in Chapter 6 of this book.The methods of protecting sensitive data that are presented in this book areprimarily focused on the protection of data at rest. In doing so, it is not tosuggest that the protection of sensitive data in transit is less of a concern whenmanaging your data security strategies. The DBA should be aware of thethreats to sensitive data in both states, when preparing solutions for those whoconsume the data they manage. Typically the strategies of protecting data intransit fall upon the shoulders of the Network Administrator who manages thephysical servers and network connections. The protection of data at rest is oftenin the realm of the DBA who architects database schemas, performs backupsand manages access to the databases. Therefore, it is valuable to presentsolutions to the challenges that are unique to the DBA.Shields and SwordsIt is not an exaggeration to say that we, as DBAs, are at war with data thieves.In our possession are assets that are valuable. The hackers, phishers, rumormongers and identity thieves all want to possess these assets. They employevery weapon and strategy that is available to them, including socialengineering, brute force attacks on databases, dumpster diving, burglary,interception of mail, network sniffing, and so on, to succeed in their efforts.Defending data is a "war", and a war cannot be won by employing only a singleweapon. As DBAs, we have many weapons and strategies available to us toprotect our sensitive data, each of which will be covered in more detailthroughout this book.Data ClassificationThe beginning of data protection is the knowledge of the data that we keep. Ifwe are unaware that we hold sensitive data in our database we will not make34