New to security.

We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed instance in Azure.

Initially we thought that VPN should provide enough security to pass data through the internet, but now our Security team wants to encrypt the connection between SQL Servers also. Is it really needed or are we being paranoid and is that redundant?


  • is the VPN access limited to the database connections? Are there users with VPN access? Depending on those factors I would say yes or no. – bradbury9 Mar 25 '19 at 14:37

The point of the VPN is to secure the traffic so it can't be snooped on. As long as each server only allows connections from each other and they're locked down properly, there shouldn't be a problem. Also be sure that there's authentication in place for the database. If something gets through the firewall somehow and tries to connect, you don't want to just let them in.

However, if you don't trust the connection from your prod machine to the VPN, or the VPN to the SQL server, you might want to encrypt it (but at that point you might as well run the VPN on the client and on the SQL server). Don't forget that encrypting it twice will add overhead, and this probably isn't something you want, especially after having to communicate with a database that's off site.

This being said, you'll probably want to go with what the security team recommends. They may have other concerns and without talking to them, we won't know what those might be.

  • The encrypted connection between the SQL servers may serve to provide secure authentication rather than strictly confidentiality. – Daisetsu Mar 25 '19 at 17:49

Your security team is being redundant. If you don't trust your VPN, you are doing VPN wrong.

They may be thinking about someone or something sniffing the data transfer on the servers, but if this is a risk, your team is not securing the server enough. And if someone can intercept the traffic on the server, encrypting the data stream will not solve the problem, because the same entity can get the encryption keys and decrypt the data.

So secure the servers, use VPN, and don't wast cycles encrypting something already encrypted "only to be sure."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.