TDE and Dynamic data mask – SQLServerCentral Forums (2024)

More actions

November 12, 2018 at 8:26 pm

#380813

Can I use TDE along with DDM at the same time?

Does the TDE encrypt the DDM or how does it work?

Thanks

More actions

November 13, 2018 at 6:10 am

#2013305

I would expect that yes, you can use both features simultaneously.

TDE encrypts your data filesAT RESTwhile DDM "masks" the data within the column(s) specified.
TDE does *NOT* actually encrypt any particular data within your database, if I gain access to your certificate used for TDE and a copy of the database, I *WILL* be able to read any and all data within said database, UNLESS that data is actually encrypted by another tool (IE a function on the application side.)

More actions

November 14, 2018 at 9:55 am

#2013500

This does work. I tested it today to verify.

TDE encrypts data at rest. When an authorized user connects and queries data, the database engine decrypts the data in memory, and that's where DDM takes over and masks the data before sending results to the client.

DDM does not encrypt or secure things. It returns masked results.

More actions

November 14, 2018 at 11:22 am

#2013528

Thanks.
So that means they can use together.
I understand TDE encrypts data at rest, the mdf, ldf and backup file. It does not encrypt data in dataabase.

The DDM still works with TDE. and masks the data.