Home/ Questions/Q 4033796
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T11:53:30+00:00

I have to store a small number of database fields (~3) in encrypted form

  • 0

I have to store a small number of database fields (~3) in encrypted form in database tables.

In general, is it better to encrypt/decrypt data within an application using .net cryptography or encrypt/decrypt data in a database using symmetric key encryption? What are the pros/cons of the two methods?

Here is my Environment:
Application – intranet web application
Development Platform – Visual studio 2010, ASP.Net, .Net Framework 3.5
Server Operating System – Windows Server 2008
Database – SQL Server 2008

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is a great question.

    My take on it is to let the part responsible for storage of the data to also be responsible for any encryption of it. In this case, let SQL server manage the encryption.

    The primary reason is that we rarely build stand alone applications anymore. It’s more common to have multiple apps utilize the same database backend. Further, it’s more common to replace the tech used to build an app than it is to replace the database engine underneath it.

    If you do it in code, then every app that uses the data store would have to use it’s own encryption/decryption library to get access to the data. If done in sql server, then the apps can be pretty ignorant of the process while you maintain the same level of protection.

    Along with this, you should leverage the ability to encrypt connections to the SQL server, which would handle keeping the data encrypted while it’s in motion between the web/app server and the database. Also you should have SSL enabled between the browser and your web site to ensure the data is never decrypted between the browser -> web server -> database server.

    Hope that helps.

    • 0