SQL Server has two ways of encrypting data. One way is by protecting data at rest, and the second is by protecting it in transit.

Imagine the following scenario: someone has unauthorized access to your database system environment. That person finds a way to get the last database backup file, copies it, and takes it to an unsecured environment. At this moment, the security mechanism just fell apart.

This scenario illustrates what can happen when someone illegally copies, detaches, and restores your database. The consequences of such activity can be substantial, depending on the sensitivity of your data environment.

Those unpleasant situations can be avoided by using Transparent Data Encryption (TDE).

TDE performs real-time I/O encryption and decryption of the data and log files. The encryption uses a database encryption key (DEK) which is secured by using a certificate stored in the master database of the server or an asymmetric key. It provides the ability to comply...