I am connecting to a Windows 2008 R2 Server with SQL Server 2008 R2 Express installed. I am connecting through a remote connection, not on the same LAN. I am connecting to the SQL Server 2008 R2 Express through VS2010. This is simply a database connection made remotely. Is this remote connection secure? If so, how? Does SSL have anything to do with it? When connecting remotely, how are the passwords that are used to log in remotely to the SQL Server secure?
No, the connection is not secure in terms of people being able to sniff the packets, and see the data (or some of it) being returned. You'll need either certificates, IPSEC, VPN, or something similar.
If you are logging into the SQL Server using windows credentials that should be more secure - AD. However, since it's not on the same LAN, it sounds like you might be using a SQL login, which is inherently less secure that a Windows domain account.
SQL Server offer privacy (ie. are encrypted) and are tamper proof (ie. signed) if configured so. The protection is done indeed using SSL (actually is TLS, details...). See Encrypting Connections to SQL Server and How to: Enable Encrypted Connections to the Database Engine for details, including the steps to enforce it.
The question about passwords is a completely different topic. There are two authentication modes supported by SQL Server: Windows and SQL Authentication. If your connection string specifies
Windows authentication will use NTLM or Kerberos, neither of which require the password to be sent over the connection. But if you use SQL Authentication then the password will be sent over the connection during the handshake. If the connection is not protected by an SSL tunnel, then the password is in clear text and can be snooped by anybody.
As long as you enforce SSL (the articles linked show step-by-step how to do it) you are safe.
|show 1 more comment|