Overview

Databasescontainavarietyofsensitiveinformation.Thisinformationcaninclude
customers'personaldata,confidentialcompetitiveinformation,andintellectual
property.Theimpactoflostorstolendatacanresultinbranddamage,competitive
disadvantage,andfinesorlawsuits.Regulationsforprivacymandatesrequire
protectingdataatrestalongwiththedatabase.

DatabaseEncryption

Encryptionisasolutiontomakecaptureddataunreadablebyunauthorized
individuals.Optionsincludeencryptingdataattheapplicationlevel,thedatabase
level,orthestoragelevel.Storagelevelencryptionguardsagainstriskinthecase
wherestoragemediaarelost.Thisdoesnotprotectagainstmaliciousinsidersor
systemsinfectedbymalware.Applicationlevelencryptionprovidesthehighest
degreeofcontrol.Databaseencryptionprotectsdataatrestgoesfurtherthanstorage
levelencryptionwhileavoidingchangesintheapplicationlayer.
Withdatabaseencryptionineffect,onlyauthorizedapplicationscanaccess
decrypteddata.Theotherapplicationsandadministratorsseeencrypteddataonly.
Thatmeansdatacanremainprotectedevenintheeventofcertaindatabreaches
Therearestillrisksassociatedwithdatabaseencryption.Wemustconsiderthat
insidersandsystemadministratorscanaccessbothencrypteddataandencryption
keys.Inthiscasetheydohaveaccesstocleartextdata,unlesskeysaredeliberately
isolatedinadedicatedkeymanagementsystem.Superuserswithbroadaccess

rightscansubvertandpotentiallydisableencryptioncontrolsunlesssuitablechecks
andbalancesareputinplace.
Anotherissueisapplicationsthathavelegitimateaccessrightswhichareinfected
withmalwarecanstillaccessconfidentialdata.Multipledatabaseinstanceswill
typicallyrequireaccesstothesamekeys.Thiscanhaveanimpactonthecostsof
provisioningandrotatingkeysinacoordinatedfashion.Keylosscanrenderdata
unavailable,sincedecryptionwouldbeimpossible.

KeyManagement

Aproperkeymanagementsystembalancesthesimplicityofkeyaccessagainst
preventionofunauthorizedaccesstothekeys.
Thereareessentiallythreedifferenttypesofkeymanagement:
Asinglekeyfortheentiredatabase
Adifferentkeyforeachrowoftableswithencrypteddata
Acombinationapproach

UsingaSingleKey

Withthisapproach,asinglekeyisusedtoaccessanydatainthedatabase.The
biggestadvantageofusingasinglekeyisthattheencryption/decryptionroutines
willnotneedtoselectkeysfromtablesorstorethemeverytimearecordis
manipulatedinthebasetable.Theresultisthatperformanceisgenerallybetter
becauseofreducedCPUcyclesandI/Ooperations.Thebiggestdisadvantageofthis
approachisitsdependenceonasinglepointoffailure.Ifanintruderbreaksintothe
databaseanddeterminesthekey,theentiredatabasebecomesimmediately
vulnerable.Inaddition,ifyouwanttochangethekey,youwillneedtochangeall
oftherowsinallofthetables,whichmaybequiteanextensivetaskinalarge
database.

UsingaKeyforEachRow

Withthisapproach,adifferentkeyisusedforeachrowofatable.Thisapproachis
farmoresecurethanthesinglekeyapproach.Evenifathiefsucceedsinstealinga
key,onlyonerowwillbecompromised,nottheentiretableorthedatabase.There
aresomedisadvantagesofthisapproach:theproliferationofkeysmakesit
extremelydifficulttomanagethem.Also,becauseencryptionanddecryption
operationsneedtogenerateorretrieveadifferentkeyforeachrow,performance
willsuffer.

UsingaCombinedApproach

Theprosandconsofthetwooptionsdiscussedare:
Withtheonekeyapproach:
1. Thekeymanagementisextremelysimple.Thereisonlyonekeyto
managecreate,access,andbackup.
2. Thekeycanbeplacedinmanyplacesconvenientfortheapplicationsto
access.
3. Ontheotherhand,ifthekeyiseverstolen,theentiredatabasebecomes
vulnerable.
Withtheonekeyperrowapproach:
1. Thenumberofkeysequatestothenumberofrows,increasingthe
complexityofkeymanagementmoredatatobackup,morestorage,and
soon.
2. Ontheotherhand,ifasinglekeyisstolen,onlythatcorrespondingrowis
compromised,nottheentiredatabase.Thisaddstotheoverallsecurityof
thesystem.
Analternativeapproachcouldbetouseasinglekeypercolumn,wherethesame
keyappliestoalltherowsorakeypertableregardlessofthenumberofcolumns
orakeyperschemaandsoon.Thenumberofkeystobemanagedwoulddecrease
dramaticallywithanyoftheseapproaches,butofcoursethevulnerabilityofthe
datawouldincrease.