Microsoft is to add data encryption to its SQL Server
database as well as seek US federal government security
certification for the platform at its TechEd conference in San
Diego, California.
The company also will release to manufacturing a tool that
advises on best practices for administering SQL Server
databases.
Native data encryption will be featured in SQL Server
2005, codenamed Yukon and due next year, said the company. "It’s
just another layer of protection for customers to secure their
data," said Tom Rizzo, director of product management for SQL
Server at Microsoft.
With encryption support, a hacker breaking into the system to
query data still would need a password or keys to de-encrypt data,
Rizzo said. PKI infrastructures are supported by the data
encryption function.
Data encryption is of growing importance, with state governments
increasingly prone to making a company liable for unauthorised
access to unencrypted data, Rizzo said.
Additionally, Microsoft will subject SQL Server 2005 to the
federal government’s Common Criteria certification from the
National Security Agency. Common Criteria certification carries a
more rigorous standard for auditing and security processes than its
predecessor, C2.
"It’s a good step for us to show our very focused efforts around
security," Rizzo said. The move should boost SQL Server’s
usefulness in governmental agencies, including foreign governments
and corporations.
Microsoft is anticipating a high upgrade rate for SQL Server
2005. "Based on the customer excitement I’ve seen, I think a lot of
people will upgrade," Rizzo said.
However, Microsoft will not be swayed by the industry momentum
of Linux and open source, with no plans afoot to port the database
to either Linux or Unix or make any SQL Server code available
through an open source format.
"Oracle and IBM go across many platforms and you get a
homogenised release that doesn’t work very well on any one
platform," Rizzo said. "We believe that integrating deeply with
Windows is a benefit to our customers."
Microsoft also is not swayed by the popular open-source
database, MySQL, and questions the supposed cost benefits, Rizzo
said.
He highlights one customer at TechEd which chose SQL Server over
MySQL.
"Primarily, we chose [SQL Server] for scalability," said Tim
Kelly, technical director of technology at TSYS, which provides
credit card processing services. Manageability also was a benefit,
he said.
SQL Server is more expensive than MySQL on a per-licence basis,
costing thousands of dollars per processor for the enterprise
version of SQL Server as opposed to minimal, almost-free cost of
MySQL, said Kelly. But costs rose when support expenses were
factored in, he said. Support costs for MySQL represented "a
five-figure difference" over SQL Server, making SQL Server the
cost-saver overall, Kelly said.
He applauded the security enhancements planned for SQL Server
2005 as well as database mirroring, which can create the appearance
of uptime even though a datacentre may be lost.
Microsoft will also release to manufacturing its Best Practices
Analyser for SQL Server 2000, which has been in beta release.
Releasing to manufacturing means the tool will be available
shortly. "It’s an automated scanning tool of your SQL Server
system for best practices compliance," Rizzo said.
The free, graphical tool examines factors such as whether the
database is being backed up on a regular basis and the division of
data on transaction logs. A command line interface is featured to
enable development of scripts to run the tool in an automated
fashion.
Also featured in the tool is a Yukon upgrade advisor, to enable
users to prepare for upgrades to SQL Server 2005. The tool will
advise administrators on issues such as changes in the T/SQL query
language between SQL Server 2005 and SQL Server 2000.
"The reason we did that was to make it easier for customers to
understand where they are in their SQL Server investment and how
they can get to SQL Server 2005," Rizzo said.
Already in a first beta release, SQL Server 2005 will be subject
to a second beta version by June and a third beta release, with 20
customers going live with the product, by the end of the year.
Paul Krill writes for InfoWorld