A One-Slide Summary of the Differences Between TDE and Always Encrypted

The folks on Twitter liked this, so sharing it here:

It’s a one-slide summary from a SQL Critical Care client’s deck, so obviously it’s abridged, but I think it does a pretty good job of summing things up.

Some highlights of the conversation:

That’s it. That’s the post. If you want more words and pictures, follow @BrentO on Twitter.

Previous Post
Remember “Nothing Stops a Hekaton Transaction?” Yeah, About That.
Next Post
[Video] The Top 10 Developer Mistakes That Won’t Scale on Microsoft SQL Server

7 Comments. Leave new

  • John Boncek
    July 31, 2020 9:27 am

    Discussions about protecting data from DBAs, etc., always leave me wondering, “Don’t you have to trust somebody at some point?” Perhaps you could do (or already have) a discussion about a credible scenario where even DBAs aren’t supposed to have access to data, and what would be required to truly achieve that.

    • Roman Brauchle
      August 3, 2020 12:37 am

      As a DBA you should feel lucky about about apps that encrypted data. If you can’t see it plain you don’t need to sign contracts about not using the data. Just think of a database with salaries. Ever signed a contract which said you have to keep it as a secret forerver even if you leave the company?

      • I completely agree! As a DBA, I don’t wanna see anything I shouldn’t be seeing. I’d rather not know.

      • It turns out, using salary as an example, that’s a really hard problem. Sure, I can encrypt salary client side so as a DBA you can’t see it. But, what about paychecks/paystubs? Sure, it’s not exactly salary (your withholding might be different, overtime, etc..) but it gets me close. Okay, encrypt that too. Oh, but then depending on how your payroll and/or bank operates, you might have a ledger entry for that paycheck or a bank transaction record for it. Pretty soon, you’re encrypting a lot of stuff for something as simple as salary.

  • “Discussions about protecting data from DBAs,”… but why does everyone always focus solely on the DBA’s? How about keeping the scope to how it should be.. protect data from any account whom has at least direct read access to sensitive data in the database and has no valid reason to view it – for a hypothetical example I wouldn’t need to see credit card information as my role wouldn’t encompass card payments. I couldn’t write that within the original tweet due to character limitations with what I’d already wrote. Trust went royally out of the window with Snowden; DBAs as well as other type of admins around the world have been paying the price ever since :-). However like Roman, I am more than happy if apps are encrypting data that I and others are not meant to see.

  • TDE is becoming a more commonly-requested feature by third parties, especially financial institutions such as lenders and banks, so it pays to understand it.

    TDE is easy to implement and word as advertised.

    • It’s because they foolishly see the word encryption and think “eh if they do that everything is happy with the world”. It’s a tool in the chest, checks a box and that’s about it. If you are going to hack the data, let’s face it, it’s probably easier and quicker to get what you need via the front door and not try to obtain the underlying database files or backups.


Leave a Reply

Your email address will not be published. Required fields are marked *

Fill out this field
Fill out this field
Please enter a valid email address.