Security boost for SQL Server

Security boost for SQL Server

Microsoft is to add data encryption to its SQL Server database as well as seek US federal government security certification for the platform at its TechEd conference in San Diego, California. 

The company also will release to manufacturing a tool that advises on best practices for administering SQL Server databases.

Native data encryption will be featured in SQL Server 2005, codenamed Yukon and due next year, said the company. "It’s just another layer of protection for customers to secure their data," said Tom Rizzo, director of product management for SQL Server at Microsoft.

With encryption support, a hacker breaking into the system to query data still would need a password or keys to de-encrypt data, Rizzo said. PKI infrastructures are supported by the data encryption function. 

Data encryption is of growing importance, with state governments increasingly prone to making a company liable for unauthorised access to unencrypted data, Rizzo said. 

Additionally, Microsoft will subject SQL Server 2005 to the federal government’s Common Criteria certification from the National Security Agency. Common Criteria certification carries a more rigorous standard for auditing and security processes than its predecessor, C2. 

"It’s a good step for us to show our very focused efforts around security," Rizzo said. The move should boost SQL Server’s usefulness in governmental agencies, including foreign governments and corporations. 

Microsoft is anticipating a high upgrade rate for SQL Server 2005. "Based on the customer excitement I’ve seen, I think a lot of people will upgrade," Rizzo said.

However, Microsoft will not be swayed by the industry momentum of Linux and open source, with no plans afoot to port the database to either Linux or Unix or make any SQL Server code available through an open source format. 

"Oracle and IBM go across many platforms and you get a homogenised release that doesn’t work very well on any one platform," Rizzo said. "We believe that integrating deeply with Windows is a benefit to our customers." 

Microsoft also is not swayed by the popular open-source database, MySQL, and questions the supposed cost benefits, Rizzo said.

He highlights one customer at TechEd which chose SQL Server over MySQL.

"Primarily, we chose [SQL Server] for scalability," said Tim Kelly, technical director of technology at TSYS, which provides credit card processing services. Manageability also was a benefit, he said.  

SQL Server is more expensive than MySQL on a per-licence basis, costing thousands of dollars per processor for the enterprise version of SQL Server as opposed to minimal, almost-free cost of MySQL, said Kelly. But costs rose when support expenses were factored in, he said. Support costs for MySQL represented "a five-figure difference" over SQL Server, making SQL Server the cost-saver overall, Kelly said. 

He applauded the security enhancements planned for SQL Server 2005 as well as database mirroring, which can create the appearance of uptime even though a datacentre may be lost. 

Microsoft will also release to manufacturing its Best Practices Analyser for SQL Server 2000, which has been in beta release. Releasing to manufacturing means the tool will be available shortly.  "It’s an automated scanning tool of your SQL Server system for best practices compliance," Rizzo said. 

The free, graphical tool examines factors such as whether the database is being backed up on a regular basis and the division of data on transaction logs. A command line interface is featured to enable development of scripts to run the tool in an automated fashion. 

Also featured in the tool is a Yukon upgrade advisor, to enable users to prepare for upgrades to SQL Server 2005. The tool will advise administrators on issues such as changes in the T/SQL query language between SQL Server 2005 and SQL Server 2000. 

"The reason we did that was to make it easier for customers to understand where they are in their SQL Server investment and how they can get to SQL Server 2005," Rizzo said. 

Already in a first beta release, SQL Server 2005 will be subject to a second beta version by June and a third beta release, with 20 customers going live with the product, by the end of the year.

Paul Krill writes for InfoWorld

Read more on IT strategy