1

New to security.

We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed instance in Azure.

Initially we thought that VPN should provide enough security to pass data through the internet, but now our Security team wants to encrypt the connection between SQL Servers also. Is it really needed or are we being paranoid and is that redundant?

Cheers

1
  • is the VPN access limited to the database connections? Are there users with VPN access? Depending on those factors I would say yes or no.
    – bradbury9
    Mar 25, 2019 at 14:37

2 Answers 2

3

The point of the VPN is to secure the traffic so it can't be snooped on. As long as each server only allows connections from each other and they're locked down properly, there shouldn't be a problem. Also be sure that there's authentication in place for the database. If something gets through the firewall somehow and tries to connect, you don't want to just let them in.

However, if you don't trust the connection from your prod machine to the VPN, or the VPN to the SQL server, you might want to encrypt it (but at that point you might as well run the VPN on the client and on the SQL server). Don't forget that encrypting it twice will add overhead, and this probably isn't something you want, especially after having to communicate with a database that's off site.

This being said, you'll probably want to go with what the security team recommends. They may have other concerns and without talking to them, we won't know what those might be.

1
  • The encrypted connection between the SQL servers may serve to provide secure authentication rather than strictly confidentiality.
    – Daisetsu
    Mar 25, 2019 at 17:49
-1

Your security team is being redundant. If you don't trust your VPN, you are doing VPN wrong.

They may be thinking about someone or something sniffing the data transfer on the servers, but if this is a risk, your team is not securing the server enough. And if someone can intercept the traffic on the server, encrypting the data stream will not solve the problem, because the same entity can get the encryption keys and decrypt the data.

So secure the servers, use VPN, and don't wast cycles encrypting something already encrypted "only to be sure."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .