Episode 87: Advances in Always Encrypted and Transparent Data Encryption
Nov 15, 2023
auto_awesome
Michael's colleagues Pieter Vanhove and Mirek Sztajno discuss updates to Always Encrypted and Transparent Data Encryption in SQL Server and Azure SQL DB. They explore key rotation, database-level key specification, advancements in database encryption, secure enclaves in Azure SQL databases, and compare TDE with Always Encrypted for data security.
Transparent Data Encryption (TDE) now supports AKV for managing keys, offering improved security and key rotation.
Always Encrypted with secure enclaves enables enhanced query functionalities and in-place encryption, providing flexible data protection options.
Deep dives
Transparent Data Encryption (TDE) Innovations
The transparent data encryption (TDE) team introduced new features focused on customer-managed keys and enhanced protection. Customers can now use AKV (Azure Key Vault) to manage keys, granting ownership and control. TDE secures databases, transaction logs, and tempDB, with options for system-managed or customer-managed keys. The update includes key rotation, allowing for increased security by periodically changing key versions.
Always Encrypted Advancements with Secure Enclaves
The always encrypted feature evolved to include secure enclaves, introducing stronger encryption and enhanced query capabilities. Secure enclaves delegate encrypted data computation securely, enabling richer query functionalities like 'larger than' and 'smaller than', which previously had limitations. This new version supports in-place encryption, eliminating the need to move data outside for encryption. It also offers flexibility with options like Intel SGX and VBS enclaves, accommodating varying compute needs for securing sensitive data.
Choosing Between TDE and Always Encrypted
When considering security defenses, the choice between TDE and always encrypted depends on mitigating different threats. TDE focuses on protecting against stolen drives or volumes, especially for backups, while always encrypted encrypts data at rest and in use. Each solution has distinct use cases for safeguarding data. TDE safeguards backups and volumes, while always encrypted operates with secure enclaves for query processing. Understanding the unique security benefits of each is crucial in designing a comprehensive Azure SQL database solution.
In this episode, Michael talks with his colleagues Pieter Vanhove and Mirek Sztajno about updates to Always Encrypted and Transparent Data Encryption in SQL Server and Azure SQL DB.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode