2

I am going to store data in an encrypted SQL Server CE 4 database, where the database is doing the encryption. (Note that SQL CE is the embedded version, not the fully installed server.)

When the data is decrypted does that only happen in memory or is it possible that is is logged or paged to disk in an unencrypted format?

The database will be accessed by an ASP.Net MVC application running in IIS.

|improve this question
1

If you are serious about the security of your data you shouldn't be using SQL CE, but rather a full blown SQL instance running on a dedicated box. Whether it pages cleartext to disk is wholly irrelevant to the overall security posture of your application because you're running an embedded SQL server in your web server process.

To answer your question though: Windows has the power to persist your memory to disk and there isn't much SQL CE can do to stop it because the data is present in IIS memory.

|improve this answer
  • Thanks for the answer Steve, but the question relates to whether any paged data will be encrypted. Also it is not correct that SQL server would improve security. The use of an embedded DB in this situation was part of a design review with a CLAS Consultant during which the use of a full SQL Server instance was ruled out due to being less secure. Also, in general, as CE is embedded in the application, it presents a smaller attack surface than a full SQL Server installation. – Sean Kearon May 17 '13 at 7:03
  • It really depends on your threat model. Yes a full SQL server increases your attack surface, but hosting it on the same box as IIS means one less server to compromise so it negates any value, especially because we're talking about crypto-protected data. If your key and data are on the same box, protected by the same processes, you have effectively no protection gained by using crypto. – Steve May 17 '13 at 20:14
  • I don't think SQL CE encrypts paged data, unless the paged data is already encrypted through a manual process. – Steve May 17 '13 at 20:17
  • Yes, that's true about the threat model. The model used by CLAS Consultants in the UK is the government certified model. As an implementer, by following that advice I am certain of best practice, which is great. As for the credentials being on the machine, these are encrypted by DPAPI and the credentials are known to a very limited number of employees. The application is also behind the firewall, not exposed on the web. Nothing's perfect, but this one is pretty tight! :) – Sean Kearon May 18 '13 at 9:12
  • I don't expect that CE is encrypting the paged data either. But I can't find any hard information about this either. – Sean Kearon May 18 '13 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.