FileStream Encryption

Question

FileStream Encryption

gwellbrock

Ten Centuries

Points: 1130
More actions
January 20, 2015 at 8:38 am

#294623

I am evaluating encryption methods for filestream as I am currently using TDE for non file data but filestream data is exposed. Using SQL 2012 enterprise in availability groups.
I have heard of Bitlocker or EFS and wondering if anyone has any positive or negative experiences with this?
Also third party vendor Vormetric has a solution that I have recently heard about but can't find any information on peoples experiences with it.
http://www.vormetric.com/data-security-solutions/use-cases/database-encryption

Viewing 12 posts - 1 through 11 (of 11 total)

You must be logged in to reply to this topic. Login to reply

AlexSQLForums SSChampion Points: 14277 More actions · Answer 1

gwellbrock - Tuesday, January 20, 2015 8:38 AM
I am evaluating encryption methods for filestream as I am currently using TDE for non file data but filestream data is exposed. Using SQL 2012 enterprise in availability groups.I have heard of Bitlocker or EFS and wondering if anyone has any positive or negative experiences with this?Also third party vendor Vormetric has a solution that I have recently heard about but can't find any information on peoples experiences with it.http://www.vormetric.com/data-security-solutions/use-cases/database-encryption

Hi gwellbrock
I'm facing the same issue on our upcoming project and would like to know which method did you go with (bitlocker, 3rd party or EFS)

Thank you

Alex S

Steve Jones - SSC Editor SSC Guru Points: 736478 More actions · Answer 2

FWIW: https://social.msdn.microsoft.com/Forums/en-US/fd5acaca-9911-4168-a82d-02a92c0d5a80/can-filestream-directory-containers-be-encrypted-with-efs?forum=sqlsecurity

I think EFS would work, or Bitlocker, but you should test

gwellbrock Ten Centuries Points: 1130 More actions · Answer 3

I ended up not going this direction because of this and storing not in filestream. Now we post blob data to S3 instead.

Steve Jones - SSC Editor SSC Guru Points: 736478 More actions · Answer 4

And link in the database with a string URL? Is there any concern about synchronization?

gwellbrock Ten Centuries Points: 1130 More actions · Answer 5

Our PDF storage MicroService actually lives in AWS and the link stored on Aurora now but I see where your concern would be if it wasn't.

Steve Jones - SSC Editor SSC Guru Points: 736478 More actions · Answer 6

Interesting and thanks for the note. Glad things are working for you.

AlexSQLForums SSChampion Points: 14277 More actions · Answer 7

Steve Jones - SSC Editor - Tuesday, May 8, 2018 8:59 AM
Interesting and thanks for the note. Glad things are working for you.

Thanks Guys
Bitlocker will not work for my case due to it's encryption on the drive level.
I'm going to configure EFS on FileStream folders based on this article https://mizitechinfo.wordpress.com/2014/07/29/step-by-step-encrypting-user-data-with-efs-in-windows-server-2012-r2/
and see how it goes.
I setup a SAN share on which FileStream is stored and will encrypt it with EFS (Windows Server 2012 R2)
I'll post my results in a few days.

Alex S

gwellbrock Ten Centuries Points: 1130 More actions · Answer 8

I'm still curious about your results thanks. Ultimately I think all that does is check a box for compliance cause someone I think can still copy those files from the directory or hash edit them or does EFS stop hash editing? Good luck!

gwellbrock Ten Centuries Points: 1130 More actions · Answer 9

gwellbrock

Ten Centuries

Points: 1130

May 9, 2018 at 9:36 am

#1989887

Disregard looks like EFS may stop hash editing!

AlexSQLForums SSChampion Points: 14277 More actions · Answer 10

AlexSQLForums - Wednesday, May 9, 2018 9:24 AM
Steve Jones - SSC Editor - Tuesday, May 8, 2018 8:59 AM
Interesting and thanks for the note. Glad things are working for you.
Thanks Guys
Bitlocker will not work for my case due to it's encryption on the drive level.
I'm going to configure EFS on FileStream folders based on this article https://mizitechinfo.wordpress.com/2014/07/29/step-by-step-encrypting-user-data-with-efs-in-windows-server-2012-r2/
and see how it goes.
I setup a SAN share on which FileStream is stored and will encrypt it with EFS (Windows Server 2012 R2)
I'll post my results in a few days.

So here is my setup.
1. Use a domain controller to setup Active Directory Certificate Services. followed this video https://www.youtube.com/watch?v=owkfin2RFDM
2. In SQL Server encrypt the folder in which FileStream data is located. folder color changes to green
At first i encrypted the FS share but after backup/restore ecnryption gets erased so then i encrypted the parent folder.
3. Test with uathorized user was successful.
4. Tested file stream operations within the app successfully.
So far it's working great and SQL Server seems to be working along with EFS.

Thank you

Alex S

NetLibSecurity Old Hand Points: 318 More actions · Answer 11

I don't know whether you are willing to consider a third party solution, however Encryptionizer for SQL Server (https://netlibsecurity.com/products/sql-server-encryption/) supports FileStream encryption and works with all versions and editions of SQL Server from Express to Enterprise. (Disclaimer: I am with NetLib Security).

This reply was modified 5 years ago by NetLibSecurity.