Ensure Azure SQL Transparent Data Encryption is enabled
Description
Transparent Data Encryption (TDE) must be enabled for all Azure SQL databases.
⚠️ Risk Impact
Without TDE, database backups and files stored on disk are readable without authentication.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Azure accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Enable TDE: az sql db tde set --database DB --server SERVER --status Enabled
💀 Real-World Attack Scenario
A backup of an Azure SQL database without TDE was stored in a Blob container. When the container's SAS token was accidentally shared publicly, the backup file was downloaded and the database was restored on a local SQL Server — giving full access to all data without any authentication.
💰 Cost of Non-Compliance
Unencrypted database backups have 100% data exposure rate when accessed. PCI DSS Req 3.4 mandates cardholder data encryption at rest. Non-compliance: $5K-$100K/month.
📋 Audit Questions
- 1.Are all Azure SQL databases using TDE?
- 2.Is TDE using service-managed or customer-managed keys?
- 3.Are database backups also encrypted?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔TDE is enabled by default on new databases but may be disabled on migrated databases
- ⛔Using service-managed keys when compliance requires customer-managed encryption
- ⛔Not verifying that TDE is active on restored databases
📈 Business Value
TDE provides transparent, zero-downtime encryption for all database files and backups. It's enabled by default but must be verified, especially for migrated databases.
⏱️ Effort Estimate
15 minutes per database to verify and enable
EchelonGraph monitors TDE status across all Azure SQL databases
🔗 Cross-Framework References
Automate CIS Azure 4.2 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →