SQL Server 2016 Security Features
- 1. SQL Server 2016 Security Features Sam Nasr, MCSA, MVP NIS Technologies March 22, 2018
- 2. Cleveland C#/VB.Net User Group Meets every month Free of charge , open to the public Meeting info: https://www.meetup.com Meeting Space courtesy of Pizza and drinks courtesy of
- 3. Housekeeping Forum for learning: feel free to ask questions Cell phones on vibrate please
- 4. Introduction Sam Nasr (@SamNasr) Software Developer (since 1995) Sr. Software Engineer (NIS Technologies) Certifications: MCSA, MCAD, MCT, MCTS President - Cleveland C#/VB.Net User Group President - .Net Study Group INETA Community Champ (2010, 2013) Author for Visual Studio Magazine Microsoft Most Valuable Professional (since 2013)
- 5. Agenda Dynamic Data Masking (DDM) "Always Encrypted“ Row-Level Security
- 6. DDM (Dynamic Data Masking) Hide specific portions of a column Users can be granted UNMASK rights Can be added to existing tables or during CREATE Does not work with encrypted values Implemented as schema change on the underlying table
- 7. DDM Functions Default: full masking per data type String: XXXX Numeric/Binary: 0000 Date/time: 01.01.1900 00:00:00.0000000 Email: aXXX@XXXX.com Random: mask numeric values using a random value. Partial:
- 8. Demo Demo #1
- 9. Always Encrypted A client-side encryption technology Auto encrypt when data is written/read by app Requires client app to use an Always Encrypted– enabled driver Client requires access to the encryption key. Other apps can query data but cannot use it without encryption key SQL Server instance never sees the unencrypted version of the data.
- 10. Always Encrypted – Setup 1. Create Column Master Key Definition 2.Create Column Encryption Key
- 11. Column Master Key Stored in a Windows certificate store 3rd Party Hardware Security Module (HSM) Requires Enterprise Edition Azure Key Vault Created via SSMS or T-SQL
- 12. Column Master Key - Setup Create on Trusted Machines, but not on Server RT-Click CMK Folder -> New Column Export CMK to all clients Web Server for web apps
- 13. Column Encryption Keys - Setup RT-Click CEK -> New CEK
- 14. Always Encrypted To insert/update encrypted data
- 15. Always Encrypted To view unencrypted data:
- 16. Demo Demo #2
- 17. Gotchas Random DDM may display actual value if random value matches actual value. Use SSMS v17.4 for Row Level Security Parameterization Always Encrypted: Other apps can query data but cannot use it without encryption key DDM is subject to bypassing using inference or brute- force techniques
- 19. References Editions and supported features of SQL Server 2016 https://docs.microsoft.com/en-us/sql/sql-server/editions-and-components-of-sql-serv Configure Always Encrypted using SQL Server Management Studio https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/config Always Encrypted (client development) https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always
Editor's Notes
- #7: DDM does not work with encrypted values (encrypted in app or Always Encrypted). DDM can be configured on the database to hide sensitive data in the result sets of queries over designated database fields, while the data in the database is not changed. Dynamic data masking is easy to use with existing applications, since masking rules are applied in the query results. Many applications can mask sensitive data without modifying existing queries
- #10: Using Always Encrypted with the .NET Framework Data Provider for SQL Server Using Always Encrypted with the JDBC Driver Using Always Encrypted with the Windows ODBC Driver
- #15: RT-Click in Query Window (not menu) ->Options Execution -> Advanced
- #20: Introducing SQL Server 2016 (Free e-book) https://blogs.msdn.microsoft.com/microsoft_press/2016/02/02/free-ebook-introducing-microsoft-sql-server-2016-mission-critical-applications-deeper-insights-hyperscale-cloud-preview-2/ https://docs.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking