I am looking for a way to secure my database! I currenctly have a sql server 2000 as my RDBMS, but we are happy to use/change to whatever product that supports proper security. By security I mean both encrypted at rest and column level encrypted. Also we need a very good separation of duties (SoD).
One of the choices would be SQL Server 2008 Enterprise Edition; but considering that the application, though very critical, is going to be used by only a few users, this would be an overkill (and the price is really high). Also it does not provide a good SoD out of the box. To get SoD, we can store keys in HSM, but that is just too much for such a small application.
The other alternative would be to use a third party provider like Protegrity. We have used them once and are really happy with their solution. The good thing about them is that we can use the current application on SQL2000 without any change and get all the security we want. But they are not really cheap either.
I guess you got what I want: the cheapest possible solution to get the security we want. I even looked at SQLCipher; not sure if it is good enough for such a critical application (what do you think?). The other thing I am not sure about SQLCipher is its multithreading support. SQLite does not seem to properly support multithreading (and yes the application does extensive multithreading). Am I incorrect?
Is SQLCipher good enough for what I want? If yes:
- do you know of any issue in porting data from SQL Server to SQLite?
- do you know if SQLite Entity Framework is stable for commercial products?
Thanks, and sorry for the long question.