Designing secure Azure SQL Database solutions
summary
Step‑by‑step build of a secure Azure SQL Database solution that pairs Azure Active Directory client auth and managed identities with TLS server auth (recommendation: encrypt=true and trust server certificate=false), Transparent Data Encryption plus keys in Key Vault, and column protection via Always Encrypted with secure enclaves (or client‑side non‑enclave mode). Tamper evidence uses a SHA-256 Merkle tree written to immutable storage or Azure Confidential Ledger; SQL Server 2022 adds TLS 1.3 support and tighter cryptographic policies. STRIDE threat modeling maps each mitigation to the threat.
AI-written summary · about
chapters (8)
- 0:00Introduction to secure design
- 3:20Transport layer security
- 8:23Client authentication
- 12:26Authorization and RBAC
- 14:18Cryptographic controls at rest
- 17:00Always encrypted technology
- 22:38Ledger and data integrity
- 26:22Threat modeling and conclusion
related talks
48mProtecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2
51mWhere should I be encrypting my data
48mGetting To Know SQL Server Encryption Capabilities
43mConfidential development with Always Encrypted using enclaves
45mA to Z Azure SQL Security Concepts
23mBuild a Defense in Depth Security Posture in Azure
19mEnhancing Security in Azure Cosmos DB: Best Practices
01h 15mChoose Azure SQL Database and Learn What Every Developer Should Know