Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for a way to secure my database! I currenctly have a sql server 2000 as my RDBMS, but we are happy to use/change to whatever product that supports proper security. By security I mean both encrypted at rest and column level encrypted. Also we need a very good separation of duties (SoD).

One of the choices would be SQL Server 2008 Enterprise Edition; but considering that the application, though very critical, is going to be used by only a few users, this would be an overkill (and the price is really high). Also it does not provide a good SoD out of the box. To get SoD, we can store keys in HSM, but that is just too much for such a small application.

The other alternative would be to use a third party provider like Protegrity. We have used them once and are really happy with their solution. The good thing about them is that we can use the current application on SQL2000 without any change and get all the security we want. But they are not really cheap either.

I guess you got what I want: the cheapest possible solution to get the security we want. I even looked at SQLCipher; not sure if it is good enough for such a critical application (what do you think?). The other thing I am not sure about SQLCipher is its multithreading support. SQLite does not seem to properly support multithreading (and yes the application does extensive multithreading). Am I incorrect?

Is SQLCipher good enough for what I want? If yes:

  • do you know of any issue in porting data from SQL Server to SQLite?
  • do you know if SQLite Entity Framework is stable for commercial products?
Do you know of any other cheap product (DBMS and/or third party plugin) to give me this security?


Thanks, and sorry for the long question.

share

migration rejected from stackoverflow.com May 13 at 13:17

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by Iain, MichelZ, EEAA, Michael Hampton May 13 at 13:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Iain, MichelZ, EEAA, Michael Hampton
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Oracle 11g has a good arsenal for security. You can do column level and tablespace level encryption. But you are asking for cheaper solution, ain't you? –  Guru Aug 6 '09 at 5:43
comments disabled on deleted / locked posts

5 Answers

up vote 0 down vote accepted

The free edition of Oracle offers transparent data encryption.

See Feature Comparison

share
    
Thanks for the answer Eric. Even the Standard Edition One has a reasonable price. I will have to investigate it a little bit as I have never used Oracle. Is there any consideration taking into account that I am going to deploy it on MS Windows and using it through .Net? How about SoD? –  Mehdi Khalili Aug 6 '09 at 23:25
add comment

Stating the obvious here, but it might be easier to just encrypt the machine rather than the database. There are numerous FDE (full disk encryption) products that will do this on a running system and remove the need to upgrade SQL Server or switch to a different DBMS (which can be pretty painful, depending on your specific circumstances).

PGP, WinMagic, or BitLocker (depending on your OS) all seem like reasonable choices. Note that encrypting the hard drive of the machine on which the DBMS is installed will also encrypt the databases themselves.

One argument against doing this is that it's overkill: encrypting everything rather than just the database will reduce performance. That's a valid argument (though FDE solutions are heavily optimized for performance and don't appreciably reduce system speed, as far as I've noticed), so you'll need to weigh the pros/cons of this approach.

share
add comment

As one of the SQLCipher devs, I can tell you that it's only suitable for your application as an embedded database. If you need to support multiple concurrent connections, you really ought to take a look at Oracle as another user suggested above.

share
add comment

Use SQL Server 2008 Standard Edition (or even SQL Server Express as I believe it supports the built-in encryption). Encrypt at the column level using SQL Server's encryption functions. HOWEVER, store and call the keys from the application (so you're basically using EncryptByPassPhrase(). The data is encrypted in the database and the DBAs do not have the ability to decrypt. If you have a mechanism to store the keys in an encrypted manner in the registry or by accessing a file where the keys are stored encrypted (if the app is on user workstations then the key file resides on a network share), you can ensure SoD as far as key escrow is concerned, as well. And since you're encrypting at the column level, then the data at rest is encrypted, too.

share
add comment

"this would be an overkill (and the price is really high)".

So actually, what you are asking for is a Ferrari that consumes no fuel and costs close to nothing ?

share
2  
I think he's asking for a Ferrari that is impossible to break into and costs close to nothing. –  shufler Aug 6 '09 at 19:26
add comment