Encryption Solutions

TDE is actually only one of several SQL Server encryption solutions available. Each encryption solution works in different ways, however, so it is important to understand first what the available encryption solutions are and how they can be utilized.

• Cell-level encryption— Cell-level encryption encrypts individual database cells, rather than the entire database. This type of encryption is not supported for SharePoint databases.

• File-level encryption— File-level encryption includes technologies such as BitLocker and the Encrypting File System (EFS). These technologies encrypt the entire hard drive and can be used with SQL. They do not, however, encrypt backups of the SQL databases that are stored on other volumes.

• Active Directory Rights Management Services (AD RMS)— AD RMS is an encryption solution that uses encryption techniques to enforce rights protection on data, restricting what a user can and can’t do with the data (for example, can’t print, copy/paste content). AD RMS, covered in later sections of this chapter, does not encrypt the data “at rest.” It is encrypted only when it is viewed by the client.

• Transparent Data Encryption— TDE is the ideal solution for SharePoint content database encryption because it encrypts the entire database while in storage, while being used in tempdb, and when backed up. In addition, the encryption is completely handled by SQL, and SharePoint does not even know that the encryption is taking place.