3

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not encrypted at rest). Their concerns were mostly along the following lines:

Data-center employees that have access to the VMs also have access to the database. We should use TDE to make sure that they can't get access to customer data from our database.

My reasoning is that if a data-center employee has administrator login access to the VM that hosts the SQL Server then they automatically gain access to the keys used for TDE. Which defeats the purpose of TDE in that case. The only real benefit to TDE would be for securing backups of the database.

Am I wrong in thinking so? And are there any alternatives to securing the whole database, relatively painlessly?

Improve this question
4
  • Quick question: why would you give the data centre employee access to the VM? – Rory Alsop♦ Oct 11 '14 at 17:10
  • 1
    @RoryAlsop With SQL Azure, Microsoft manages the SQL Server instances for you. It's more of a PaaS model than IaaS in that all you're buying are individual databases. You can have VMs in Azure that you install SQL Server on, but that's not what the SQL Azure SKUs are. – Xander Oct 11 '14 at 17:54
  • FYI SQL azure now has TDE msdn.microsoft.com/en-us/library/dn948096.aspx – Rory May 7 '15 at 12:11
  • I hold that SQL's ability to encrypt data at rest provides very little actual protection. If I got online access to the machine I'd not be stopping it to go for the MDF and LDF files but executing takeover of some SQL account and dumping data by SELECT. If I got copies of the disks I'd be starting the machine and doing the same procedure. Now are you going to set your machines up to they require a human to give a password at bootup? – Joshua Sep 9 '15 at 15:21
2

No, your understanding of TDE is not wrong. A user with the appropriate permissions on the SQL Server instance can access the data in the database, and with SQL Azure, even if TDE were enabled, the DBAs in charge of the instance would certainly still have full access to the data.

What can you do? Well, you can encrypt the data in the application before you ever send it to the database. This creates a whole slew of additional constraints on how you query and use the data however, and is generally only appropriate in very limited use cases.

Ideally, you'd convince the client that this is an acceptable risk. The cloud providers business model is built around protecting their clients' data, not stealing it. It isn't in their best interest to abuse their position of trust in that way.

To me this sounds like its probably a search for a technical solution to a problem that doesn't need solving. I understand the concern, but in my opinion, the concern is out of proportion to the risk.

Improve this answer
1
  • I completely agree that the concern is out of proportion with the risk. But I wanted to ensure that my understanding of TDE is not incorrect. Of course, we do encrypt some of the data at the application level (ie. passwords) but many other fields such as customer names and addresses we do not since that would disable pretty much all but the most basic of queries.. – Mike Dinescu Oct 11 '14 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.