Skip to main content

💼 4.10 Ensure SQL server's TDE protector is encrypted with BYOK (Use your own key)

  • Contextual name: 💼 4.10 Ensure SQL server's TDE protector is encrypted with BYOK (Use your own key)
  • ID: /frameworks/cis-azure-v1.1.0/04/10
  • Located in: 💼 4 Database Services

Description​

TDE with BYOK support provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties.

With TDE, data is encrypted at rest with a symmetric key (called the database encryption key) stored in the database or data warehouse distribution. To protect this data encryption key (DEK) in the past, only a certificate that the Azure SQL Service managed could be used. Now, with BYOK support for TDE, the DEK can be protected with an asymmetric key that is stored in the Key Vault. Key Vault is a highly available and scalable cloud-based key store which offers central key management, leverages FIPS 140-2 Level 2 validated hardware security modules (HSMs), and allows separation of management of keys and data, for additional security.

Based on business needs or criticality of data/databases hosted a SQL server, it is recommended that the TDE protector is encrypted by a key that is managed by the data owner (BYOK).

Similar​

  • Internal
    • ID: dec-c-e8128acc

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (1)​

PolicyLogic CountFlags
📝 Azure SQL Server Transparent Data Encryption Protector is not encrypted with Customer-managed key 🟢1🟢 x6

Internal Rules​

RulePoliciesFlags
✉️ dec-x-230b5e351