Data protection
The core component in data protection, apart from discovery and classification covered in the last chapter, is data encryption. This can be done depending on the state of the data, as seen in Figure 11.1.
Figure 11.1 – Data is either at rest, in transit, or in use
Data is either at rest (inside the database or storage), in transit (when moving the data from one place to another), or in use. While the data is at rest or in transit, the data should be encrypted to maximize security.
Encryption at rest
The first layer of protection is provided by Azure automatically, by encrypting data at rest using one of the strongest block ciphers in the world, 256-bit Advanced Encryption Standard (AES) encryption.
The key for this server-side encryption (SSE) can be managed either by the platform (Microsoft-managed key) or by the organization (customer-managed key).
A second layer of data encryption can be added for SQL databases: transparent...
