Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have SQL Server 2008 standard edition running on Windows Server 2003.

I need to encrypt the databases.

One obvious option is to upgrade to enterprise edition and use TDE.

However, this might not be an option due to cost.

Can anyone provide any information about if it is possible to use Windows Encrypting File System to encrypt the SQL Server Data directories?

Would this work? Would this cause any major performance hit?

Any other alternatives would also be greatly appreciated.

share|improve this question

1 Answer 1

You'd have an overhead in the OS that SQL Server wouldn't know about and would cause issues (similar to why NTFS compressions shouldn't be used for SQL Server).

I also wouldn't bother because:

  • your backups (in the backup system or on tape) won't be encrypted
  • nor will data over the network to your client code/servers
  • complicates restores/DR etc
  • doing it cheaply is not doing it correctly
  • enabling it on the server is pointless when you have so many other angles of attack to get the data.
share|improve this answer
    
Thanks... this is what I need to get the funding for enterprise! –  Robin Day Aug 17 '11 at 11:34
    
@Robin Day: TDE will give you encrypted backups which is arguable more important then on the server. End to end (eg https to web server, SSL from web to Db server) is also required for a full lock down. Someone who can access the server can sniff network traffic etc even if they can't read the SQL Server files –  gbn Aug 17 '11 at 12:57
    
@gbn Can you explain why EFS would always result in plaintext backups? –  Steven Jenkins Sep 29 at 19:15
    
@StevenJenkins: The backup is always plain text (changed now in SQL Server 2014). Only the persistence on EFS is encrypted. Suble difference. Will you have EFS everywhere (and SSL for network transfers) on your SAN/NAS/tapes/etc?> –  gbn Sep 30 at 15:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.