Protecting Azure SQL against data leakage and theft (database encryption)

Databases store sensitive information that should not be exposed. To mitigate the risk of data exposure and theft, we need to ensure that data encryption is enforced at all levels (at rest and in transit). There are different features of Azure SQL that help us to achieve this. Let's look at them.

Implementing Transparent Data Encryption (TDE) – encryption at rest

Data, backups, and logs in Azure SQL databases are stored on storage systems located in Microsoft-managed data centers. To mitigate the risk of data leakage in case of storage disk theft, or unsecured decommissioning of storage media in the data centers, the service transparently encrypts data before storing it on disks. This functionality is referred to as Transparent Data Encryption (TDE). The great thing is that this functionality is enabled by default!

With TDE, data is transparently encrypted before it is stored on disks. Data...