Security and Governance

Defense-in-Depth Security Model

Layered security, each layer provides independent protection:

1. Encryption at rest (TDE) — protects against physical media theft
2. Encryption in transit (TLS/SSL) — protects against network interception
3. Access control (RBAC/ABAC) — enforces least privilege
4. SQL injection prevention — protects against application-layer attacks
5. Audit logging — accountability and forensic capability

Encryption at Rest (TDE)

Encrypts DB files on disk without application changes. Encrypts data pages before writing, decrypts on read into memory. AES 128/256-bit symmetric encryption. Transparent to applications.

Key Hierarchy (SQL Server)

1. Service Master Key (Windows DPAPI) -> 2. Database Master Key -> 3. Certificate -> 4. Database Encryption Key (DEK)