Understanding the cryptographic controls in Azure SQL Database
summary
Overview of actual controls and tradeoffs: Azure SQL uses TLS for transport with recommended settings Encrypt=True and TrustServerCertificate=False (SQL Server 2022 adds encrypt=strict and TLS 1.3 support). At-rest protection is TDE with platform or customer-managed keys, auto-rotation, user-assigned identities and optional per-database CMKs. Confidential data uses Always Encrypted (non-enclave deterministic equals only; Always Encrypted with VBS enclaves enables richer LIKE queries). Ledger produces Merkle trees stored in immutable blob storage to detect tampering.
AI-written summary · about
chapters (7)
- 0:00Introduction to security
- 2:02Cryptographic framework
- 4:13Cryptography on the wire
- 13:27Data at rest encryption
- 16:36Always encrypted technology
- 32:24Ledger and data integrity
- 36:19Conclusion and resources
related talks
48mProtecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2
43mConfidential development with Always Encrypted using enclaves
45mA to Z Azure SQL Security Concepts
19mTop Security Questions: Delight Your CISO and Protect Your Business
51mWhere should I be encrypting my data
48mGetting To Know SQL Server Encryption Capabilities
48mKeep the Integrity of your Database with Azure SQL Ledger
51mSecuring Azure Cosmos DB