Home/ Questions/Q 8687987
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T23:15:04+00:00

Possible Duplicate: Is it possible to password protect an SQL server database even from

  • 0

Possible Duplicate:
Is it possible to password protect an SQL server database even from administrators of the server?

I am hosting my database on SQL Server 2008 on a windows 7 machine. The Windows 7 machine and the SQL Server 2008 are controlled and administered by third party admins.

I have sensitive information in my database.

How do I secure my database, so that the third party admins do not look at the sensitive data?

Is there any way to restrict the third party admins from copying the stored procedures, table designs etc.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Only to a limited degree.

    If they are administering the actual SQL Server Instance as well they have the “keys to the kingdom”. They can view the definitions of every object, make changes to the definitions or the data, and do virtually anything else. Even if they merely have admin rights on the machine but not the server, they can get admin on the server through certain techniques which are generally considered valid rather than bugs or exploits. It is after all their server and the server will obey them.

    In a situation like this, you need to be able to trust those admins at least to a degree. If you cannot trust them, you should ideally not be hosting with them at all, and if you can’t trust them and must host with them, try to get your own VM where you can at least apply some additional security and auditing.

    There are a few things you can do though, but none are completely effective.

    The first is encryption. If you meet all the requirements and set it up properly, SQL’s transparant data encryption can prevent an admin without the keys from reading the data (but they can still see the structure!) in the database. This is quit effective at protecting the actual data (but not the structure) but is difficult to set up properly.

    You can use the “with encryption” option to protect your stored procedures. This is very weak protection and its very easy to get around this. But it at least sends a strong message to the curious that you don’t want them looking and makes them jump through some hoops.

    Traces and auditing will also help you determine what happened and see if they did anything, but those come at a performance price.

    • 0