What should be Database encryption strategy ?

Question

In MS SQL Server 2005/2008 standard encryption all data in the database is encrypted using the SMK/DMK scheme. In this scheme a key is issued for each client connecting to the database. What would a hacker sniffing network traffic will see and what should be the strategy to prohibit this

1. Would Applying Encryption inside the database will be enough.
2. Would Applying Encryption outside the database (Applying encryption where the data originates) will be necessary.
3. A Hybrid solution will be more suitable
4. Do I also need to provide a secure link (SSL) between client and server ?

Answer 1

Yes, else the attacker could grab the key off the wire as it passes to the client and can decrypt the information the same as the client. One needs to use a secure key exchange, the easiest way to do that is to push everything through SSL.