Using windows file encryption system to encrypt SQL database files

[laker42]

I have a project to go through and find best SQL Server security best practices. One of the practices I came across said to use windows encrypted file system to encrypt our SQL Server database files. Has anyone done this? Is there any performance issues with doing this? I didn't know if performance would take a hit because of SQL have to encrypt & decrypt each time it does a read from the file?

Maybe my understanding of the encryption file system is off. If anyone has any experience with this, I would appreciate any input you have.



Thanks!

John

 

[mrdenny]

From what I understand of EFS there will be a performance hit, as each time the file is read/written to or from the disk there would be additional overhead of encrypting and decrypting the data.

I'd recommend to stick to NTFS permissions to keep the files them selves secure. Any sensitive data (passwords, credit card numbers, SSNs, etc) should be encrypted within the database it self.

Also keep in mind, that as long as the SQL Service is running no one else can copy the database files anyway. The SQL Service will have them locked.

Denny

--Anything is possible. All it takes is a little research. (Me)