Ooops, data breach? Not with Always Encrypted. Daniel de Sousa, BI Specialist, Dominos Pizza Enterprise Moderated By: Shane O'Neill

Transcription

1 Ooops, data breach? Not with Always Encrypted Daniel de Sousa, BI Specialist, Dominos Pizza Enterprise Moderated By: Shane O'Neill

2 Technical Assistance If you require assistance during the session, type your inquiry into the question pane on the right side. Maximize your screen with the zoom button on the top of the presentation window. Please fill in the short evaluation following the session. It will appear in your web browser.

3 Thank You to Our Sponsors Empower users with new insights through familiar tools while balancing the need for IT to monitor and manage user created content. Deliver access to all data types across structured and unstructured sources. Redgate Software makes ingeniously simple software used by 650,000 IT professionals who work with SQL Server,.NET, and Oracle. More than 100,000 companies use Redgate products, including 91% of the Fortune 100. Redgate s philosophy is to design highly usable, reliable tools which elegantly solve the problems that developers and DBAs face every day.

4 Join PASS PASS is a not-for-profit organization which offers year-round learning opportunities to data professionals. Access to online training and content Join Local Groups and Virtual Groups Get advance notice of member exclusives Enjoy discounted event rates MEMBERSHIP IS FREE, JOIN TODAY

5 Daniel de Sousa Business Intelligence Dominos Currently working on data compliance project between multi countries and continents Data lover Been working with data since 1994(dBase III Plus, all SQL servers) Currently using SQL 2016 SP1 daniel-de-sousa-0b419828/ Soccer Fanatic Love my Brazilian soccer, mainly Corinthians Father of 2 going on the same path

6 Ooops, data breach? Not with Always Encrypted Daniel de Sousa, BI Specialist, Dominos Pizza Enterprise

7 Ooops, data breach? Not with Always Encrypted Daniel de Sousa

8 Daniel de Sousa Business Intelligence Dominos Currently working on data compliance project between multi countries and continents Data lover Been working with data since 1994(dBase III Plus, all SQL servers) Currently using SQL 2016 SP1 daniel-de-sousa-0b419828/ Soccer Fanatic Love my Brazilian soccer, mainly Corinthians Father of 2 going on the same path

9 Agenda Encryption - Concepts Always Encrypted - Concepts Always Encrypted DB Permissions Parameterization Certificate Management Limitations

10 Encryption - Concepts According to Wikipedia In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it. Encryption does not of itself prevent interference, but denies the intelligible content to a would-be interceptor. In an encryption scheme, the intended information or message, referred to as plaintext, is encrypted using an encryption algorithm, generating ciphertext that can only be read if decrypted. An authorized recipient can easily decrypt the message with the key provided by the originator to recipients but not to unauthorized users.

11 Always Encrypted - Concepts According to Microsoft Docs Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine (SQL Database or SQL Server). As a result, Always Encrypted provides a separation between those who own the data (and can view it) and those who manage the data (but should have no access). By ensuring on-premises database administrators, cloud database operators, or other high-privileged, but unauthorized users, cannot access the encrypted data, Always Encrypted enables customers to confidently store sensitive data outside of their direct control. This allows organizations to encrypt data at rest and in use for storage in Azure, to enable delegation of on-premises database administration to third parties, or to reduce security clearance requirements for their own DBA staff.

12 Always Encrypted - Concepts

13 Always Encrypted - Concepts Column Master Key (CMK) Protects the column encryption key(s). Stored in a trusted key store like Windows Certificate Store, Azure key Vault, etc Column Encryption Key (CEK) Protects the encrypted columns. Stored in the database Column-level encryption setting Deterministic Randomized Connection string Column Encryption Setting = enabled;

14 DEMO 01

15 ALTER ANY COLUMN MASTER KEY Always Encrypted DB Permissions ALTER ANY COLUMN MASTER KEY ALTER ANY COLUMN ENCRYPTION KEY VIEW ANY COLUMN MASTER KEY DEFINITION VIEW ANY COLUMN ENCRYPTION KEY DEFINITION

16 ALTER ANY COLUMN MASTER KEY Always Encrypted DB Permissions

17 Parameterization Client Application must use When inserting data to Always Encrypted columns New feature SSMS 17 automatically converts Transact-SQL variables into query parameters works only in Query Editor windows that use database connections with Always Encrypted enabled The type of the literal used for the initialization of the variable to be parametrized, must match the type in the variable declaration. If date type or a time type, the variable must be initialized using a string using one of the following ISO 8601-compliant formats. Intellisense used and blue squiggle

18 DEMO 02

19 Certificate Management Provisioning Column Master Keys Provisioning Column Encryption Keys Rotating Column Master Keys Rotating Column Encryption Keys

20 Certificate Management Provisioning Column Master Keys Certificate Store Current User Certificate Store Local computer Azure Key Vault Key Store Provider (CNG) Cryptographic Service Provider (CAPI) deprecated Disabled by default

21 Certificate Management Provisioning Column Encryption Keys Certificate Store Local computer Azure Key Vault Key Store Provider (CNG) Cryptographic Service Provider (CAPI)

22 Certificate Management Rotating Column Master Keys Replace an existing CMK with a new CMK Required if CMK compromised May be required to comply with organization s policies Decrypt CEKs protected with the current CMK, re-encrypt them using the new CMK, and updating the key metadata

23 Certificate Management Rotating Column Encryption Keys Decrypts all the data in all encrypted columns and reencrypt with the new CEK Can be very lengthy process Requires careful planning and Outage: NO applications can write to the impacted tables

24 DEMO 03

25 Limitations Deterministic Encryption requires _BIN2 collation. A CEK can have two encrypted values (for key rotation) Queries can only perform operations on deterministic encryption Only the equals (=) operation is allowed in queries. (No >, <, <>, like, etc.) Queries must pass values as parameters, not literals. Limited data types Key columns in indexes only allow deterministic encryption NO CDC NO FOR XML or FOR JSON PATH During Encryption process, there can be no inserts or updates as it may result in data corruption And More can be checked at Microsoft Docs(reference)

26 Summary Always Encrypted basically requires a change to the connection string Data is encrypted and protected once it leaves the client Encrypted data is protected from sysadmin on the server Certificate management is crucial to protecting your data

27 QUESTIONS?

28 DEMO 05

29 References Always Encrypted (Database Engine) Always Encrypted Column Encryption Metadata

30 QUESTIONS?

31 Coming up next! Securables, Principals, and Permissions John Deardurff

32 THANK YOU FOR ATTENDING

33