TDE Tablespace Encryption is a must-have in the cloud and something that most of us have to learn. I recently gave a presentation on the basics and what you will need to learn to survive in the cloud.
If you are interested in the recording, it is uploaded to our YouTube channel. It is 43 minutes and no one will probably see it from start to end. But you should really have a look at the Secure External Password Store. It is a really awesome feature. There is a demo right here.
The presentation was organized together with the Danish Oracle User Group and I have also published the slides.
I made a quick poll during the presentation to ask how many years the attendees had worked with databases without worrying about encryption. The answers ranged from eight to 35 (or even 42 – but was that a joke?). The majority was above 20. But with the evolution of the cloud this is about to change. You must learn about encryption these days.
I also mentioned some indications that AES256 is not necessarily more secure than AES128 (the latter being the default encryption algorithm in Oracle Database 19c). I can’t tell you why – that’s way beyond my knowledge – but here are the references:
Also, there was a comment from Asger stating that an encrypted database is hard to compress by your storage system. That is true – normally encryption is bad for your compression ratio. Unless you use compression options that are built into the database. It will compress the data before it is encrypted. You can have your cake – and eat it!
And just a few final words of advice:
- Always back up your keystore
- Never delete a keystore
- Never forget your keystore password
I had much fun talking about TDE. The more I explore, the more I like it. Thanks to those that attended.
Databases Are Fun 
Interesting post- I migrated10TB of PDF client documents from a very expensive system called IBM OnDemand to Oracle 11.2. about 10 years ago. We used TDE and were entirely happy with the outcome – the issue with encryption of the underlying file systems, however, is that it only protects from physical theft – you would need to have steal the tablespace data files as well as the wallet and its password. To prevent privileged users like DBAs accessing the application data you would need to spend money on Data Vault licenses.
LikeLike
Hi Mark,
That is an interesting perspective. And you are right. TDE Tablespace Encryption is only a part of the protection that you can or should apply. Data Vault is – as you mention – a good solution to protect against privileged users.
Regards,
Daniel
LikeLike