Pro Encryption in SQL Server 2022

This in-depth look at the encryption tools available in SQL Server shows you how to protect data by encrypting it at rest with Transparent Data Encryption (TDE) and in transit with Transport Level Security (TLS). You will know how to add the highest levels of protection for sensitive data using Always Encrypted to encrypt data also in memory and be protected even from users with the highest levels of access to the database. The book demonstrates actions you can take today to start protecting your data without changing any code in your applications, and the steps you can subsequently take to modify your applications to support implementing a gold standard in data protection.

The book highlights work that Microsoft has been doing since 2016 to make encryption more accessible, by making TDE available in the standard edition, and the introduction of Always Encrypted that requires minimal work on your part to implement powerful and effective encryption, protecting your data and meeting regulatory requirements. The book teaches you how to work with the encryption technologies in SQL Server with the express goal of helping you understand those technologies on an intuitive level. You’ll come away with a deep level of understanding that allows you to answer questions and speak as an expert. The book’s aim is to make you as comfortable in deploying encryption in SQL Server as you would be in driving your car to buy groceries.

Those with a data security mindset will appreciate the discussion of how each feature protects you and what it protects you from, as well as how to implement things in the most secure manner. Database administrators will appreciate the high level of detail around managing encryption over time and the effect of encryption on database performance. All readers will appreciate the advice on how to avoid common pitfalls, ensuring that your projects to implement encryption run smoothly.

WHAT YOU WILL LEARN

* Architect an effective encryption strategy for new applications
* Retrofit encryption into your existing applications
* Encrypt data at rest, in memory, and in transit
* Manage key and certificate life cycles, including backup and restore
* Recover encrypted databases in case of server failure
* Work with encryption in cloud-based scenarios

WHO THIS BOOK IS FOR

Database developers, architects, and administrators who want to work with encryption in SQL Server; those who want to maintain encryption whether data is at rest or being transmitted over the network; and those who wish to encrypt their data even when in the server’s own memory. Readers should be familiar with SQL Server, but no existing knowledge of encryption is assumed.

MATTHEW MCGIFFEN is a Data Architect with over 20 years’ experience working on SQL Server and associated technologies. Matthew has also had the opportunity to collaborate with Microsoft during the development of some of the latest enhancements in encryption. He is the author of a popular blog on SQL Server and has written articles for SQL Server Central. In his spare time, Matthew is an amateur chess player and pianist. Introduction

PART I. UNDERSTANDING THE LANDSCAPE

1. Purpose of Encryption and Available Tools.

PART II. TRANSPARENT DATA ENCRYPTION (TDE)

2. Introducing Transparent Data Encryption

3. Setting Up TDE

4. Managing TDE

5. Backup Encryption

PART III. ALWAYS ENCRYPTED

6. What Is Always Encrypted?

7. Setting Up Always Encrypted

8. Executing Queries Using Always Encrypted

9. Encrypting Existing Data with Always Encrypted

10. Limitations with Always Encrypted

11. Key Rotation with Always Encrypted

12. Considerations When Implementing Always Encrypted

PART IV. ALWAYS ENCRYPTED WITH ENCLAVES

13. Introducing Always Encrypted With Enclaves

14. Setting Up Always Encrypted With Enclaves

15. In-Place Encryption With Always Encrypted

PART V. COMPLETING THE PICTURE

16. Rich Querying With Always Encrypted Enclaves

17. Setting Up TPM Attestation

18. Encryption In Transit Using Transport Level Security

19. Hashing and Salting of Passwords

20. Extensible Key Management (EKM)

APPENDIXES

A. Glossary of Terms

B. Encryption in the Cloud

C. Encryption Algorithms.