Cyberstudy
PDF p.72 In progress

Database Encryption

Open PDF at p.72 16 flashcards

Summary

PDF p.72

Database encryption protects data stored in structured databases by encrypting data at various levels, such as database-level, record-level, and cell/column-level. This ensures data confidentiality and integrity, even if the underlying storage media is compromised. Encryption can be implemented by the database management system (DBMS) or through plug-ins, with different granular options available.

In plain words

Supplementary — not from your PDF

Databases can be encrypted at different levels: the whole database on disk (e.g. TDE), individual records, or specific columns such as card numbers. Finer levels can even keep secrets hidden from database administrators.

Detailed explanation

PDF p.72
  • Structured Database
    • Definition: Stores data in tables with column fields and rows.
    • Access: Mediated through a DBMS using SQL, typically hosted on a server.
  • Encryption Levels
    • Disk/Volume Encryption
      • Protection: Underlying files can be protected by disk or volume encryption.
      • Performance Impact: May adversely affect performance, hence encryption is often implemented by the DBMS.
  • Database-Level Encryption
    • Definition: Encrypts data when transferred between disk and memory.
    • Example: Transparent Data Encryption (TDE) in SQL Server.
    • Protection: Encrypts all records on disk and database logs, protecting against media theft.
  • Record-Level Encryption
    • Definition: Encrypts individual records to protect secrets from database administrators.
    • Public Key Encryption: Stores private keys outside the database to unlock cell values.
    • Example: SQL Server's Always Encrypted feature keeps data encrypted in memory, decrypted only by client applications.
  • Cell/Column Encryption
    • Definition: Encrypts specific fields within a table.
    • Performance Impact: Less than database-level encryption but requires identifying fields needing protection.
    • Client Access: Can complicate access; decryption keys supplied by client applications.
  • Granular Control
    • Example: Health insurer's database with protected health information.
    • Key Pairs: Each customer identified by a separate key pair for row/record-level encryption.
    • Compliance: Allows fine-grained access control to meet security and privacy requirements.

Important terms

taken from the text above
Structured Database
Stores data in tables with column fields and rows.
Performance Impact
May adversely affect performance, hence encryption is often implemented by the DBMS.
Database-Level Encryption
Encrypts data when transferred between disk and memory.
Record-Level Encryption
Encrypts individual records to protect secrets from database administrators.
Public Key Encryption
Stores private keys outside the database to unlock cell values.
Cell/Column Encryption
Encrypts specific fields within a table.
Client Access
Can complicate access; decryption keys supplied by client applications.
Key Pairs
Each customer identified by a separate key pair for row/record-level encryption.
TDE Transparent Data Encryption

Examples & real-world scenarios

Supplementary — not from your PDF
  • TDE protecting database files and backups if the disks are stolen.
  • Column encryption for a 'card_number' field only.
  • Record-level encryption where only the client app can decrypt.

Scenario

A health insurer must stop even its DBAs from reading patient diagnoses. Database-level TDE isn't enough, because the DBMS decrypts for anyone querying it. It uses record or column encryption with keys held outside the database.

Common mistakes

Supplementary — not from your PDF
  • Assuming TDE hides data from people with database access. It protects the files at rest.
  • Encrypting every column 'just because', which hurts performance with little benefit.

Practical skills

Supplementary — not from your PDF
  • Pick a database encryption level from who you need to protect data against.

What I should remember

Key Points PDF p.72
  • Structured Database
    • Tables: Data stored in tables with columns and rows.
    • DBMS: Access mediated through SQL.
  • Encryption Levels
    • Disk/Volume Encryption: Protects underlying files, may impact performance.
    • Database-Level Encryption: Encrypts data between disk and memory (e.g., TDE).
    • Record-Level Encryption: Protects individual records, uses public key encryption.
    • Cell/Column Encryption: Encrypts specific fields, requires client-supplied keys.
  • Granular Control
    • Key Pairs: Separate keys for different records.
    • Compliance: Meets security and privacy requirements.