Scribd
Upload
75 views21 pages

Security Enhancement in 2016 SQL Server

SQL Server 2016 includes several new security features including Always Encrypted for encrypting sensitive data, row-level security for fine-grained access control, dynamic data masking for hiding parts of sensitive data, and improved transparency data encryption. Always Encrypted allows applications to encrypt sensitive data in use, row-level security controls data access at the row level based on user queries, and dynamic data masking hides parts of sensitive fields using various masking functions.

Uploaded by

Atul Sharma
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
75 views21 pages

Security Enhancement in 2016 SQL Server

SQL Server 2016 includes several new security features including Always Encrypted for encrypting sensitive data, row-level security for fine-grained access control, dynamic data masking for hiding parts of sensitive data, and improved transparency data encryption. Always Encrypted allows applications to encrypt sensitive data in use, row-level security controls data access at the row level based on user queries, and dynamic data masking hides parts of sensitive fields using various masking functions.

Uploaded by

Atul Sharma
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 21

SQL Server 2016

Better Security
Concepts
Backup Encryption

Row-Level Security
Dynamic Data Masking

Always Encrypted
TLS 1.2
AES Encryption
Database Level Credentials
TDE Offload
Security Features in SQL Server 2016

Transparen Dynamic
Always Row-Level
t Data Data
Encrypted Security
Encryption Masking
Always Encrypted
Client Libraries encrypt
inbound data when it is use by
SQL Server

Requires .NET 4.6--other


libraries available soon

Encrypted data can be queried


and indexed
Always Encrypted—SQL Architecture
Column
Column Master
Encryption Keys--
Keys--protecting
protecting keys
keys used to
used to encrypt
encrypt column
column
encryption keys
encryption keys
Creating a Table with Always Encrypted Columns
Indexing and Always Encrypted
DETERMINISTIC columns may be indexed

RANDOMIZED or DETERMISITIC may be used in include


statements

These are treated like regular indexes

More I/O and network bandwidth will be consumed by these


indexes
Always Encrypted—SQL Server
Deterministic Randomized

• Can perform equality operations • Most secure


• Can perform grouping operations • Does not allow grouping
• Allows indexing on encrypted • Does not allow equality operations
columns on encrypted columns
• Should be used for data with large • Good for columns with small
domain of distinct values domain of distinct values
• Should not be used for data with
limited domain of distinct values
(e.g. birthdays)
• May leak statistical information
Transparent Data Encryption

Performs Export files are


Encrypts backups
encryption at rest not encypted so
and data files
only be careful
TDE—SQL Server 2016
Support for In-Memory OLTP

Stretch Database Support


Support for Intel AES-NI hardware
acceleration
• This reduces CPU resources for TDE
Cell Level Encryption
Used for sensitive data stored in the
database
Configure with symmetric key and
certificates
Long term replacement is Always
Encrypted
Row Level Security
Allows configuration to only allow users to see
rows that they are granted access to
Silently filters rows—users have no insight

Uses filter and block predicates for security


Row Level Security
RLS Predicates are
Controls access to
functionally
rows based on the
equivalent to a
user executing the
WHERE clause in a
query
query
Row Level Security—Practical
Implementation
Create inline table
function

Bind security policy


to that function
Row Level Security--Sample Code
Dynamic Data Masking
Allows
you to Call center where reps
show a need to verify last 4 of
limited SSN
image
of
sensitiv
e data Allow developers to
query production
environments without see
personally indentifable
information
Dynamic Data Masking Policies

Admin Users Excluded

Policies set which users are subject to masking


Masking Rules—Which fields are masked and which
pattern
Masking functions—Method for which data to expose
Dynamic Masking Functions
Default Full Masking based on data types of the field (no data
exposed)
Credit Card Shows the last four digits of a credit card number

Social Method shows the last 4 digits XXX-XX-1234


Security
Number
Random Generates random numbers according to the boundaries
Number
Custom Text Exposes first and last characters and adds custom string in the
middle
Dynamic Data Masking – Azure SQL DB
In SQL DB there is a
This feature was first recommendation
introduced in SQL engine to
DB recommend DDM
fields
Adding Masking to a New Table
Other Security Enhancements
The default
Credentials can
encryption for
now be scoped
endpoints
at the database
changes from
level
RC4 to AES

You might also like