Presentation is loading. Please wait.

Presentation is loading. Please wait.

Protect Your Data's Privacy! Data Encryption with SQL Server Joe

Published byChester Freeman Modified over 8 years ago

Similar presentations

Presentation on theme: "Protect Your Data's Privacy! Data Encryption with SQL Server Joe"— Presentation transcript:

1 Protect Your Data's Privacy! Data Encryption with SQL Server Joe Kuemerle @jkuemerle www.kuemerle.com

2 Background of Joe Kuemerle Lead Developer at BookingBuilder Technologies Over 15 years of development experience with a broad range of technologies Focused on application and data security, coding best practices and regulatory compliance Presenter at community, regional and national events.

3 What Is Encryption

4 Encryption is the process of mathematically altering data in a consistent, reversible fashion. It should be used to store sensitive information that will need to be retrieved later. Encryption relies on a secret that is the only viable way to reverse the mathematical process Encryption can be Symmetric where a single value (the encryption key) is used to both encrypt and decrypt the data Or Encryption can be Asymmetric where there are two values in that data encrypted with Value 1 can only be decrypted with Value 2 and vice versa. This is also know as Public Key Encryption

5 What Is Encryption “Encryption is the process of substituting a small secret in place of a large secret”

6 Symmetric Encryption Asymmetric Encryption

7 Certificates Certificates are used to store asymmetric keys and consist of a private key and public key. SQL Server provides built in management of certificates Do not use use certificates to encrypt data, it is slow and can be vulnerable when storing lengthy values. Use a symmetric key to encrypt the data and a certificate to encrypt the symmetric key.

8 Hashes Hashes are not an encryption method. A hash takes an input value and transforms it to a unique value that is infeasible to convert back to the original value. Hashes are not for storing data that needs to be re- read but are for proving knowledge of a secret without the actual secret being revealed. Hashes are ideal for verifying passwords. The actual password is unimportant we just need to have the user prove that they know the password.

9

10 Hashes Best practices call for the use of SHA256, SHA384, SHA512 or higher functions Bcrypt is a “Future-Adaptable” open source hashing algorithm Do not use MD5 or SHA1as there are proven methods for undermining the hash results. SQL Server 2005/2008 only support MD5 & SHA1, Denali supports SHA256 SHA384 and SHA512

11

12

13

14 Demos Yay! No more bullet points. All source code is available on CodePlex: http://sqlcrypto.codeplex.com/

15 References Laurentiu Christofor: http://blogs.msdn.com/lcris/http://blogs.msdn.com/lcris/ Raul Garcia: http://blogs.msdn.com/raulgahttp://blogs.msdn.com/raulga Bruce Schneier: http://www.schneier.com/http://www.schneier.com/ http://blogs.msdn.com/b/sqlsecurity/archive/2010/06/14 /database-encryption-key-dek-management.aspx http://blogs.msdn.com/b/sqlsecurity/archive/2010/06/14 /database-encryption-key-dek-management.aspx Cryptography: o http://www.garykessler.net/library/crypto.html http://www.garykessler.net/library/crypto.html o http://www.cacr.math.uwaterloo.ca/hac/ http://www.cacr.math.uwaterloo.ca/hac/ BCrypt: o http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow- tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow- tables-what-you-need-to-know-about-s.html o http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ o http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-strong-password- hashing-for-dotnet-and-mono.ashx http://derekslager.com/blog/posts/2007/10/bcrypt-dotnet-strong-password- hashing-for-dotnet-and-mono.ashx Demo source: http://sqlcrypto.codeplex.com

16 @jkuemerle / joe at kuemerle.com http://www.speakerrate.com/jkuemerle

17 Photo Credits http://www.flickr.com/photos/wwworks/4612188594 http://www.flickr.com/photos/joyosity/3358614462 http://www.flickr.com/photos/jmrosenfeld/31582581 5 http://www.flickr.com/photos/jmrosenfeld/31582581 5 http://www.flickr.com/photos/23258385@N04/22258 09637 http://www.flickr.com/photos/23258385@N04/22258 09637 http://www.flickr.com/photos/chelseamcnamara/4 058966236 http://www.flickr.com/photos/chelseamcnamara/4 058966236 http://xkcd.com/538/

Download ppt "Protect Your Data's Privacy! Data Encryption with SQL Server Joe"

Similar presentations

Public Key Infrastructure and Applications

Public Key Infrastructure and Applications
Using Cryptography to Secure Information. Overview Introduction to Cryptography Using Symmetric Encryption Using Hash Functions Using Public Key Encryption.

Using Cryptography to Secure Information. Overview Introduction to Cryptography Using Symmetric Encryption Using Hash Functions Using Public Key Encryption.
CIS 193A – Lesson6 CRYPTOGRAPHY RAPELCGRQ. CIS 193A – Lesson6 Focus Question Which cryptographic methods help computer users maintain confidentiality,

CIS 193A – Lesson6 CRYPTOGRAPHY RAPELCGRQ. CIS 193A – Lesson6 Focus Question Which cryptographic methods help computer users maintain confidentiality,
Computer Science CSC 474By Dr. Peng Ning1 CSC 474 Information Systems Security Topic 2.1 Introduction to Cryptography.

Computer Science CSC 474By Dr. Peng Ning1 CSC 474 Information Systems Security Topic 2.1 Introduction to Cryptography.
Digital Signatures and Hash Functions. Digital Signatures.

Digital Signatures and Hash Functions. Digital Signatures.
Cryptography. 2 Objectives Explain common terms used in the field of cryptography Outline what mechanisms constitute a strong cryptosystem Demonstrate.

Cryptography. 2 Objectives Explain common terms used in the field of cryptography Outline what mechanisms constitute a strong cryptosystem Demonstrate.
Principles of Information Security, 2nd edition1 Cryptography.

Principles of Information Security, 2nd edition1 Cryptography.
Dr Alejandra Flores-Mosri Message Authentication Internet Management & Security 06 Learning outcomes At the end of this session, you should be able to:

Dr Alejandra Flores-Mosri Message Authentication Internet Management & Security 06 Learning outcomes At the end of this session, you should be able to:
BY MUKTADIUR RAHMAN MAY 06, 2010 INTERODUCTION TO CRYPTOGRAPHY.

BY MUKTADIUR RAHMAN MAY 06, 2010 INTERODUCTION TO CRYPTOGRAPHY.
Apr 22, 2003Mårten Trolin1 Agenda Course high-lights – Symmetric and asymmetric cryptography – Digital signatures and MACs – Certificates – Protocols Interactive.

Apr 22, 2003Mårten Trolin1 Agenda Course high-lights – Symmetric and asymmetric cryptography – Digital signatures and MACs – Certificates – Protocols Interactive.
Cryptographic Technologies

Cryptographic Technologies
Chapter 9 Information Systems Controls for System Reliability— Part 2: Confidentiality and Privacy Copyright © 2012 Pearson Education, Inc. publishing.

Chapter 9 Information Systems Controls for System Reliability— Part 2: Confidentiality and Privacy Copyright © 2012 Pearson Education, Inc. publishing.
Introduction to Cryptography

Introduction to Cryptography
Encryption Methods By: Michael A. Scott 20140508.

Encryption Methods By: Michael A. Scott
Chapter 8.  Cryptography is the science of keeping information secure in terms of confidentiality and integrity.  Cryptography is also referred to as.

Chapter 8.  Cryptography is the science of keeping information secure in terms of confidentiality and integrity.  Cryptography is also referred to as.
Digital Signature Xiaoyan Guo/102587 Xiaohang Luo/104446.

Digital Signature Xiaoyan Guo/ Xiaohang Luo/
Cryptography 101 Frank Hecker

Cryptography 101 Frank Hecker
Sorting Out Digital Certificates Bill blog.codingoutloud.com ··· Boston Azure ··· 13·Dec·2012 ···

Sorting Out Digital Certificates Bill blog.codingoutloud.com ··· Boston Azure ··· 13·Dec·2012 ···
31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

31.1 Chapter 31 Network Security Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
© Neeraj Suri EU-NSF ICT March 2006 DEWSNet Dependable Embedded Wired/Wireless Networks MUET Jamshoro Computer Security: Principles and Practice Slides.

© Neeraj Suri EU-NSF ICT March 2006 DEWSNet Dependable Embedded Wired/Wireless Networks MUET Jamshoro Computer Security: Principles and Practice Slides.

Similar presentations

Ads by Google