Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In MS SQL Server 2005/2008 standard encryption all data in the database is encrypted using the SMK/DMK scheme. In this scheme a key is issued for each client connecting to the database. What would a hacker sniffing network traffic will see and what should be the strategy to prohibit this

  1. Would Applying Encryption inside the database will be enough.
  2. Would Applying Encryption outside the database (Applying encryption where the data originates) will be necessary.
  3. A Hybrid solution will be more suitable
  4. Do I also need to provide a secure link (SSL) between client and server ?
share|improve this question
add comment

1 Answer

Yes, else the attacker could grab the key off the wire as it passes to the client and can decrypt the information the same as the client. One needs to use a secure key exchange, the easiest way to do that is to push everything through SSL.

share|improve this answer
    
Per BOL ms-help://MS.SQLCC.v10/MS.SQLSVR.v10.en/s10de_4deptrbl/html/c75d0d4b-4008-4e71-9‌​a9d-cee2a566bd3b.htm employing TDE in SQL Server does not provide encryption across communication channels. MS recommends SSL to ensure encrypt data across channels so eanm89 is correct in recommending SSL. –  jl01 Nov 30 '11 at 15:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.