(Cross-posting this here on the advice of a user at stackoverflow...)
Got a philosophical security question for everyone. I'm sketching out an ASP.NET web application design where sensitive data for different organizations/clients will be stored in a SQL Server database. User authentication will use ASP.NET Forms Authentication.
Encrypting the entire database using Transparent Database Encryption (TDE) is a no-brainer. But I'm curious if we should bother with cell-level encryption (using something like the SQL Server Label Security Toolkit found at codeplex.com: SQL Server Label Security Toolkit).
If we were to do cell-level encryption, then we could associate each user of an organization/client to a single SQL user account that has the ability to read/write data for their organization. So, in case a SQL user account was compromised, it would limit the data access to just that single organization.
But let's suppose we created a single SQL user account/password that is only intended for the web application to communicate securely with the database (no direct access to the database for reporting purposes will be allowed). We can set it up with a sufficiently long, randomly generated password, with those credentials stored encrypted in the web.config file.
At this point, have we sufficiently secured access to sensitive data in the the database (assuming the application limits what is displayed, of course)?
In other words, suppose we had multiple SQL user accounts with ridiculously long passwords encrypted in the web.config file. If one of those SQL user accounts were compromised, then that would mean a security flaw exists that would likely mean all the SQL user accounts were compromised. So, no security value-add really exists.
(The most compelling reason I can think of to do cell-level encryption by client-specific SQL users would be to prevent a security hole in the actual web application from displaying data from another client.)
Hope the question makes sense. Be interested to hear other's thoughts on this! Thanks in advance.