Transparent Data Encryption known also known as TDE (learn more), encrypts SQL Server, Azure SQL Database and Azure SQL Data Warehouse data and log files on the OS-level. Moreover, a derived benefit is that also SQL Server-based backups of encrypted databases are also encrypted. This type of encryption can be characterized as encrypting data at rest. In other words, it encrypts stored data (storage can be persistent storage like a disk drive or tape).
In this article, I’m providing a list with 10 facts that you should definitely know about Transparent Data Encryption in SQL Server.
10 Facts about SQL Server Transparent Data Encryption (TDE):
- TDE is supported in SQL Server 2008 (Enterprise Edition only) or later, Azure SQL Database and Azure SQL Data Warehouse,
- When enabling TDE, you should immediately back up the certificate and the private key associated with the certificate to a safe location,
- Backup files of databases that have TDE enabled are also automatically encrypted by using the database encryption key,
- In SQL Server 2016 or later, backup compression for TDE-enabled databases is fully supported (learn more here),
- If even a single database on a SQL Server instance is encrypted using TDE, then the “tempdb” system database will be automatically encrypted too,
- By the time a single database is encrypted using TDE, and thus tempdb is automatically encrypted, this will have a performance effect for unencrypted databases too on the same SQL Server instance.
- FILESTREAM data is not encrypted even when TDE is enabled,
- Files related to buffer pool extension (BPE) are not encrypted when a database is encrypted using TDE,
- In SQL Server 2016 and later, as well as in Azure SQL Database In-Memory OLTP, log records and data are encrypted if TDE is enabled. However, in SQL Server 2014 In-Memory OLTP, only log records are encrypted if TDE is enabled since files in the MEMORY_OPTIMIZED_DATA filegroup are not encrypted,
- When you encrypt a database in SQL Server, Azure SQL Database or Azure SQL Data Warehouse, you do not need to do anything on the application-level because as the name of TDE implies, it is totally transparent and does not require any changes on the application.
Secure your SQL Server Instances with DBA Security Advisor
DBA Security Advisor, is our SQL Server security tool, which can help you assess your SQL Server instances against a rich set of security checks. The assessment report, includes recommendations and remediation scripts that can help you better secure your SQL Server instances and databases (learn more…).Try DBA Security Advisor free for 30 days!
Strengthen your SQL Server Administration Skills – Enroll to our Online Course!
Check our online course on Udemy titled “Essential SQL Server Administration Tips” (special limited-time discount included in link).
Via the course, you will learn essential hands-on SQL Server Administration tips on SQL Server maintenance, security, performance, integration, error handling and more. Many live demonstrations and downloadable resources included!
Featured Online Courses:
- Boost SQL Server Database Performance with In-Memory OLTP
- Essential SQL Server Administration Tips
- SQL Server Fundamentals – SQL Database for Beginners
- Essential SQL Server Development Tips for SQL Developers
- The Philosophy and Fundamentals of Computer Programming
- .NET Programming for Beginners – Windows Forms with C#
- Introduction to Data Science and SQL Server Machine Learning
- Introduction to Azure SQL Database for Beginners
- SQL Server 2019: What’s New – New and Enhanced Features
- Entity Framework: Getting Started – Complete Beginners Guide
- How to Import and Export Data in SQL Server Databases
- Learn How to Install and Start Using SQL Server in 30 Mins
- A Guide on How to Start and Monetize a Successful Blog
Other SQL Server Security-Related Articles
- How to Enable SSL Certificate-Based Encryption on a SQL Server Failover Cluster
- Why You Need to Secure Your SQL Server Instances
- [DBNETLIB] [ConnectionOpen (SECDoClientHandshake()).] SSL Security Error – How to Resolve
- Should Windows “Built-In\Administrators” Group be SQL Server SysAdmins?
- SQL Server Row Level Security by Example
- Frequent Password Expiration: Time to Revise it?
- Policy-Based Management in SQL Server
- The “Public” Database Role in SQL Server
- Encrypting SQL Server Databases
- Transparent Data Encryption (TDE) in SQL Server
- Encrypting a SQL Server Database Backup
- …check all
Check our latest software releases!
Easily generate snippets with Snippets Generator!
Secure your databases using DBA Security Advisor!
Convert static T-SQL to dynamic and vice versa with Dynamic SQL Generator.
Rate this article:
Reference: SQLNetHub.com (https://www.sqlnethub.com)
Artemakis Artemiou is a Senior SQL Server Architect, Author, a 9 Times Microsoft Data Platform MVP (2009-2018) and a Udemy Instructor. He has over 15 years of experience in the IT industry in various roles. Artemakis is the founder of SQLNetHub and TechHowTos.com. Artemakis is the creator of the well-known software tools Snippets Generator and DBA Security Advisor. Also, he is the author of many eBooks on SQL Server. Artemakis currently serves as the President of the Cyprus .NET User Group (CDNUG) and the International .NET Association Country Leader for Cyprus (INETA). Moreover, Artemakis teaches on Udemy, you can check his courses here.