encryption support for database

Question

I am looking for a way to secure my database! I currenctly have a sql server 2000 as my RDBMS, but we are happy to use/change to whatever product that supports proper security. By security I mean both encrypted at rest and column level encrypted. Also we need a very good separation of duties (SoD).

One of the choices would be SQL Server 2008 Enterprise Edition; but considering that the application, though very critical, is going to be used by only a few users, this would be an overkill (and the price is really high). Also it does not provide a good SoD out of the box. To get SoD, we can store keys in HSM, but that is just too much for such a small application.

The other alternative would be to use a third party provider like Protegrity. We have used them once and are really happy with their solution. The good thing about them is that we can use the current application on SQL2000 without any change and get all the security we want. But they are not really cheap either.

I guess you got what I want: the cheapest possible solution to get the security we want. I even looked at SQLCipher; not sure if it is good enough for such a critical application (what do you think?). The other thing I am not sure about SQLCipher is its multithreading support. SQLite does not seem to properly support multithreading (and yes the application does extensive multithreading). Am I incorrect?

Is SQLCipher good enough for what I want? If yes:

• do you know of any issue in porting data from SQL Server to SQLite?
• do you know if SQLite Entity Framework is stable for commercial products?

Do you know of any other cheap product (DBMS and/or third party plugin) to give me this security?

Thanks, and sorry for the long question.

Answer 1

The free edition of Oracle offers transparent data encryption.

See Feature Comparison

Answer 2

"this would be an overkill (and the price is really high)".

So actually, what you are asking for is a Ferrari that consumes no fuel and costs close to nothing ?

Answer 3

Use SQL Server 2008 Standard Edition (or even SQL Server Express as I believe it supports the built-in encryption). Encrypt at the column level using SQL Server's encryption functions. HOWEVER, store and call the keys from the application (so you're basically using EncryptByPassPhrase(). The data is encrypted in the database and the DBAs do not have the ability to decrypt. If you have a mechanism to store the keys in an encrypted manner in the registry or by accessing a file where the keys are stored encrypted (if the app is on user workstations then the key file resides on a network share), you can ensure SoD as far as key escrow is concerned, as well. And since you're encrypting at the column level, then the data at rest is encrypted, too.

Answer 4

As one of the SQLCipher devs, I can tell you that it's only suitable for your application as an embedded database. If you need to support multiple concurrent connections, you really ought to take a look at Oracle as another user suggested above.

Answer 5

Stating the obvious here, but it might be easier to just encrypt the machine rather than the database. There are numerous FDE (full disk encryption) products that will do this on a running system and remove the need to upgrade SQL Server or switch to a different DBMS (which can be pretty painful, depending on your specific circumstances).

PGP, WinMagic, or BitLocker (depending on your OS) all seem like reasonable choices. Note that encrypting the hard drive of the machine on which the DBMS is installed will also encrypt the databases themselves.

One argument against doing this is that it's overkill: encrypting everything rather than just the database will reduce performance. That's a valid argument (though FDE solutions are heavily optimized for performance and don't appreciably reduce system speed, as far as I've noticed), so you'll need to weigh the pros/cons of this approach.