[MUSIC]
Hi, my name's Tommy Mullaney and I'm on the engineering team for
SQL Server.
Today, I'm excited to walk you through the security capabilities
that we have in SQL Server on Linux.
The key message that I'd like to leave you with today
is that SQL Server on Linux supports the same enterprise-grade security
capabilities that customers rely on with SQL Server on Windows today,
and it's all built-in.
Now for SQL Server, we think about security in terms of layers, and
what we call defense in-depth.
At the center, you have your data.
Now the first layer of security is how you protect the data itself,
typically by using encryption.
The second layer is how you control access,
who is allowed to access which parts of your data.
And the outer layer is how you monitor access,
tracking the activities that are happening against your database.
SQL Server has features that empower customers to secure
each of these layers.
I'd like to run through a few that I think are especially important,
to show you how SQL Server on Linux supports the same security
capabilities that it supports on Windows.
So first, let's talk about the innermost layer, protecting data.
This is about encrypting data so that it's protected from
different threats as it moves across your application stack.
For example, encryption at rest is a very common requirement for
costumers who want to protect their data in case the files or
disk are stolen.
SQL Server enables you to protect your data at rest
with varying degrees of granularity using features like transparent data
encryption, back up encryption, or cell-level encryption.
I want to highlight transparent data encryption in particular
because it's so commonly used.
This feature encrypts your entire database, the data, log, and
back up files, without requiring any application changes.
It works on Linux just like it does on Windows.
Now the next type of encryption is called encryption in transit.
This means encrypting communications with SQL Server
using the latest industry standard TLS 1.2 protocol.
Just like on Windows, SQL Server on Linux supports TLS 1.2 and
it can be configure to be FIPS 140-2 compliant if
your operating system is running in FIPS mode.
The other type of encryption I want to call out is called
client-side encryption.
SQL Server on Linux supports a really cool feature
called Always Encrypted.
Always Encrypted enables you to protect highly sensitive
columns of data like social security numbers or
other personally identifiable information so that even high
privileged database administrators can not access the plaintext.
It works by encrypting the data on the client side and
typically requires only minimal changes to your application
because our enhanced client drivers like ODBC or
JDBC handle all the encryption and decryption for you.
So returning to our diagram, the next layer of security
is about controlling access through authentication and authorization.
SQL Server supports several features that enable you to control
access to data within the database itself.
For example, SQL Server has a very granular permission system
allowing you to control access to specific tables or
even individual columns of data.
In particular, though, I want to highlight that like on Windows,
SQL Server on Linux will support Active Directory authentication.
Active Directory authentication enables password-less single-sign on
using the industry standard Kerberos protocol.
And it enables administrators to manage access centrally and
at scale using Active Directory groups.
This feature is extremely useful for large enterprises in particular
where you want individuals to have a single identity across the entire
organization and across both your Windows and Linux machines.
Now, while Active Directory authentication isn't available just
yet on Linux, keep an eye out on our monthly builds and
you'll see it coming out very soon.
While features like permissions and Active Directory authentication
control access at the database layer, SQL Server also supports
several programmability features that make it easier for you to
control which data can be accessed through the application layer.
For instance, row-level security allows you to control
access to specific rows in a table based on the querying user's role,
department, tenant ID, or other criteria.
By attaching this access logic to the database table itself,
you simplify your application code and
you reduce the risk of accidental data exposure.
Similarly, dynamic data masking allows you to mask query results on
the fly according to a centralized policy within the database.
For example, you might only expose the area code of a phone number, or
the domain of an email address to end users of an application.
Again, by having SQL Server enforce the masking policy,
you simplify your application code, and
reduce the risk of accidental data exposure.
Now the outer layer of security is about monitoring access,
keeping track of who does what in your database.
Just like on Windows, SQL Server on Linux supports a fine grained
audit feature which allows you to specify which users, actions and
objects should be tracked.
And then the database engine will log all activities based on
this policy.
This feature is commonly used by customers who need an audit trail in
order to meet certain compliance standards.
So, there you have it, the layers of SQL Server security.
Our team has worked really hard to ensure that SQL Server on Linux
supports the same enterprise-grade security capabilities that our
customers rely on with SQL Server on Windows today.
We're really excited about these features because
they make it easier than ever before to secure your
data at a time when data protection is more important than ever.
So with that, we look forward to your feedback and
thanks so much for watching.
[MUSIC]