>> The third topic we're going to cover is data protection.
>> Now, as part of data protection,
certainly one of the things in SQL Server
you think about is encryption.
We have all those options for you in
Azure just like you have in SQL Server.
For example, we force encryption connections on
the backend using TLS for Azure Database and for Managed Instance.
We support Column Level Encryption just like you can use to
T-SQL using SQL Server today.
Transparent Data Encryption, which is data encryption at rest,
it's actually on by default.
In Azure SQL Database and in Managed Instance,
you can't turn that off,
but you also have the ability to bring your own key,
and one of the techniques that we often recommend
customers do that in Azure is with something like Azure Key Vault.
Now, Always Encrypted, a technology that we launched in SQL 16 and
enhanced in 19 is also available
with Azure SQL Database and Managed Instance.
We don't have secure enclaves yet available in the Azure space,
but the entire Always Encrypted Suite without that is available,
and that's an interesting option for you to consider for
a complete end-to-end encryption scenario where the application
itself really holds the ability to do all the encryption,
also helping prevent things like man in the middle attacks.
Encryption is a big part of the Data Protection Suite and we offer
all the options that you would want and get in
SQL Server with Azure SQL.
But the next part of doing protection,
you might consider something called Dynamic Data Masking.
>> Dynamic Data Masking is really
around to make sure people that don't
need access to seeing sensitive data don't have access to that.
If you'll take a look at this example,
we're using T-SQL here,
and basically what we're doing is we're masking
the information that is sensitive to most end-users.
Now, only if you're granted
unmask will you be able to see the sensitive information.
You see there's a few options that we have there.
For example, for the Social Security,
you can do a partial mask and specify how to do it,
maybe leaving the last two or four numbers
of the Social Security number.
For e-mail, we have a specific format which will basically take
that and obfuscate most of the characters there.
Then you can also use a random mask,
which is what we were doing for salaries,
so just replacing it with a random number between one and 20,000.
Now, only if you're granted unmask will you be able to see those.
If you grant unmask and then you need to take it away,
you can also do a revoke unmask.
Now, this is awesome as it is,
but with the Azure SQL portal,
you can actually go in and
see recommended fields to mask and this is going
to be based on things that
Azure SQL picks ups as sensitive information.
>> You saw us talk about encryption
and talk about Dynamic Data Masking.
The fact that pretty much of the features that you know and
love and SQL Server exists for Azure SQL.
So from our perspective to set up and configure this,
it really comes down to the following things:
we force encryption to the backend,
but you shouldn't force encryption on
your client app when connecting the Azure SQL,
because since we enforce it in the backend,
if you enforce it on the client will avoid
any negotiation which could actually
increase latency if you don't do that.
Evaluate your use of TDE.
We enable TDE by default,
but you should take a look at it whether that meets your needs,
we recommend you use it.
There could be reasons from a performance perspective
that TDE is not the right thing for you,
so you do have the option of disabling that if you want to.
Remember, you always have that ability using
Azure Key Vault to bring your own keys.
Take advantage of Dynamic Data Masking.
Take a look at the Azure portal and
recommendations we give you on what mask.
Remember, that is a great separation of you
applying security principles on the server,
separated from putting that logic in your application.
Then take a hard look at Always Encrypted because again,
it's a great end-to-end encryption scheme that
could meet the needs today of your application,
what other encryption techniques really don't apply.
We've seen all aspects of data protection,
is the third element of
securing your assets in Azure SQL Database.
Looking forward to seeing you in the next video.