SQL Server 2005 Encryption - sql-server

Question

I am developing an intranet application that contains a few connection strings in a database table with passwords (the previous developer did this - I know it is bad practice). The plan was to upgrade from SQL Server 2005 to SQL Server 2008, so I was going to wait for this and then use TDE (Transparent Data Encryption) as no changes are required to code even when the data is encrypted.
I have now discovered that we are not upgrading to SQL Server 2008. What other options do I have to minimise changes required to the application? I thought of using the encryption facility in the web.config but I believe a lot of changes will be required. What other options do I have? There are two client applications that connect to it i.e. VB6 and VB.NT.

Answer 1

I can think of three options that you can take. First is to have your system administrator provision a service account from active directory, grant the same permissions as the sql account, then configure the Application Identity property in the advanced settings of the application pool in IIS. You will then be able to remove the username and password from the configuration string and replace it with the property "trusted_connection=true".
Second, you can apply column level encryption to encrypt the connection strings stored in your database. It can be done without any code changes for your intranet app. You will need to rename the table, create a view with the old table name containing the function decryptautokeybycert. I'll post an example at the end of the post.
Third, you can have the DBA configure the server to force all connections to be encrypted using SSL\TLS.
use master
go
create database EncryptedData
go
use EncryptedData
create master key encryption by password='P#ssw0rd!'
create certificate KeyProtection with subject='Key Protection'
create symmetric key ColumnKey
with algorithm=AES_256
encryption by certificate KeyProtection
create table SecretMessages(Ciphertext varbinary(4000))
go
create view dbo.MessageRecords
as
select
cast(DECRYPTBYKEYAUTOCERT( cert_id('KeyProtection'), null,Ciphertext) as varchar(max)) MessageRecord
from dbo.SecretMessages
go
open symmetric key ColumnKey decryption by certificate KeyProtection
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 1'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 2'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 3'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 4'))
insert into SecretMessages(Ciphertext) values (ENCRYPTBYKEY(key_guid('ColumnKey'),'Hello world 5'))
close symmetric key ColumnKey
select * from MessageRecords