SQL Server Transparent Data encryption

Question

I have implemented TDE for the Database and Column Level Encryption for Sensitive data in Tables. But, the Porblem is the data is entered through an front end application how could i encrypt this data when it is inserted from the Front end. And how to decry-pt
this data for the users when it is selected.
Your suggestions are most valuable.
Reagrds
Rehaan Khan
RehaanKhan. M

Answer 1

Let me start with a solution that may have been overlooked, but it is good to make sure we cover it. Have you considered using column-level permissions? It may not be a complete solution for your particular scenario if you need to give access to the column
for other reasons (after all, the group you are trying to restrict is probably developing applications on top of the column storing sensitive data) or if the developer group has permission to create objects that would render the sensitive data subject to ownership
chains. For more information on column-permissions look at
http://msdn.microsoft.com/en-us/library/ms186915.aspx
Assuming permissions alone will not solve the problem. By using encryption you should be able to limit access to the sensitive data to the developers, but it will also require some changes to your schema & application. TDE (Transparent Data Encryption)
will not help you in this scenario since you need to restrict access to the data and restricting access to the column is not sufficient.
The following links may be useful to get you started with SQL Encryption capabilities:
SQL Server Encryption (http://msdn.microsoft.com/en-us/library/bb510663.aspx)
Data Encryption in SQL Server (http://msdn.microsoft.com/en-us/library/bb669072(v=vs.110).aspx)
Encrypt a Column of data (http://msdn.microsoft.com/en-us/library/ms179331.aspx)
Cryptographic Functions (T-SQL) (http://msdn.microsoft.com/en-us/library/ms173744.aspx)
Older articles, but they may still be quite useful:
Indexing encrypted Data (http://blogs.msdn.com/b/raulga/archive/2006/03/11/549754.aspx)
SQL Server 2005: searching encrypted data (http://blogs.msdn.com/b/lcris/archive/2005/12/22/506931.aspx)
One recommendation may be to encrypt the data using an AES key, and protect the key using one or more certificates (I would recommend using a separate certificate per individual if possible), making sure that only authorized people have access to the keys.
Anyone else with access to the column, but not to the keys would not be able to decrypt the data.
BTW. I would also recommend using SQL Auditing (http://msdn.microsoft.com/en-us/library/cc280386.aspx) in order to keep honest people honest, by monitoring access to the keys & to the
sensitive data.
I hope this information helps,
-Raul Garcia
SQL Server Security
This posting is provided "AS IS" with no warranties, and confers no rights.