Quick intro: Small company, VERY limited resources. I pretty much do everything including coffee. I am a programmer, not a security guy. That's why I ask you...
We have an MS-SQL 2008 Database running on our server and several C# Applications that connect to the Database directly using a connection string like this
"Server=example.org; Database=SomeDatabase; User Id=dbUser; password=**secret**; Encrypt=YES"
The applications do not run on the server, so the Database instance is facing to the outer world. This setup is running great, but I have some concerns.
1) What does the Encrypt=YES
exactly mean? Is the whole connection (including logon etc.) safe (assuming nobody gets hands on the connection string)? Or should I have serious concerns? What are these concerns (keywords appreciated)?
2) What is a good strategy to distribute the connection string?
To explain the second question: It is very comfortable to connect just directly. The distribution of the connection string could be replaced more easily than wrapping all calls to the database into another more secure channel...