Post reply

Using windows encryption file system to encrypt SQL database files

  • March 5, 2004 at 9:23 am

    #359285

    I have a project to go through and find best SQL Server security best practices.  One of the practices I came across said to use windows encrypted file system to encrypt our SQL Server database files.  Has anyone done this?  Is there any performance issues with doing this?  I didn't know if performance would take a hit because of SQL have to encrypt & decrypt each time it does a read from the file?  Maybe my understanding of the encryption file system is off.  If anyone has any experience with this, I would appreciate any input you have.

     

    Thanks! 

    John

  • March 8, 2004 at 8:00 am

    This was removed by the editor as SPAM

  • March 8, 2004 at 9:27 am

    #497811

    I tested this a long time ago, and can't be sure of the results, but a few things I know.

    1. There is a performance hit. I don't believe it's that bad once you get going, I think it's more when the file is first opened and then on writes. If most of your stuff comes from cache, then it won't be bad, especially with today's hardware. A few years ago that wasn't the case. Of course it depends on how busy your system is.

    2. Be sure the account running SQL Server can get to the encryption key. Easy to mess this up.

    3. This is more to prevent theft of the files if someone can get the physical disks to get admin access to the server. For most installations, I'm not sure it's really worth the hassle. If someone can get SA access, this doesn't help.

    4. IF you run your backups to non-encrypted files or don't protect the tapes, you have a huge hole and someone can get around your encryption.

  • March 10, 2004 at 11:41 am

    #498167

     

    In regards to off-site storage of backups.  I suppose the backup files could be encrypted prior to sending offsite.

    One can password protect backups.  While this would not prevent your data from being hacked at the offsite, it might prevent your backups from being restored to another server.

    So for maximum offsite security, maybe password protecting your backup and then encrypting the backup prior to shipping offsite.

    GaryA

     

  • March 12, 2004 at 9:12 am

    #498536

    Thank you for the responses.  You have confirmed what we were thinking.  The server is physically secure so I don't think we will use the encryption.  We are going to start putting passwords on our backup files.

     

    Thanks again!

    John

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply