Sitecore xDB Stale data encryption (always encrypted)

Question

As Sitecore 9 is all about Data security, clear seperation and so on, we would obviously like to put those features to work.

That is why we were wondering how the Stale data encryption that was mentioned on the xDB data actually works. Is this an application (specific) level implementation or does it use SQL TDE (Transparent Data Encryption) now that Sitecore 9 has come back into the sql fold with analytics databases.

I looked around the documentation but could not find anything specifc on this, only reference I found is on commerce and that is a best-practice advise: http://commercesdn.sitecore.net/SCpbCS81/SitecoreCommerceDeploymentGuide/en-us/DataEncryption.html

Thanks in advance

Answer 1

Prior to Sitecore 9, TDE could be used to configure data-at-rest encryption. Always Encrypted was introduced in SQL Server 2016, thus TDE was the only option for data-at-rest encryption and SSL for data-in-motion.

Always Encrypted is available in SQL Server 2016 (13.x) and SQL Database. (Prior to SQL Server 2016 (13.x) SP1, Always Encrypted was limited to the Enterprise Edition.) https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-2017

Sitecore 9 supports SQL Server 2016 SP 1 and Always Encrypted support was added as data-at-rest encryption approach. Encryption can be configured just for columns with sensitive data. The performance for all other data will not be affected.

Both, SQL Server and SQL Provider has to be configured to support Always Encrypted.

Below you can find required encryption type per column with sensitive data.

It's also required to enable always encrypted in the sc.Xdb.Collection.Data.Sql.xml configuration file in all the roles:

<UseAlwaysEncrypted>true</UseAlwaysEncrypted>

It's optional feature. As far as, Sitecore 9 uses sharded clusters with multiple shards, all the shards have to be configured individually. If you need more details, I can provide them. TDE can be configured as well. There is no official documentation that states that TDE is supported, but all the databases in PaaS are deployed with TDE enabled by default. Always Encrypted can be configured just for the 'collection' db. All other dbs do not support it.

Answer 2

The final answer from support:

You can enable Transparent Data Encryption (TDE) on your SQL Server and there is no limitation to do it because SQL Server Transparent Data Encryption does not affect "Sitecore - SQL Server" communication. It affects how SQL Server stores data in the encrypted database. Sitecore uses standard .NET techniques to communicate to SQL server (it utilizes SqlConnection .NET Framework class), therefore, all changes to "Sitecore - SQL Server" communication which are transparent for .NET SQL connection are transparent for the Sitecore application.

You should also pay attention that even after you have SQL server configured to encrypt the content of the database communication between SQL server and Sitecore application will be still unencrypted.

Answer 3

If you are referring to always encrypted feature which is provided by Sql Server, then short answer is: no, at the moment there is no official Sitecore documentation on how to enable the feature in Sitecore 9. However, considering that doc site for Sitecore 9 is constantly updated, I would expect the documentation to be published in not too distant future.

What is known so far is that Always Encrypted is an optional feature which needs to be explicitly configured. It can be enabled just for columns that contain sensitive data (e.g. contact identifiers, facet data). Column master key can be stored in either Windows Certificate store (for on-premise deployments) or Azure Key Vault.