Azure SQL连接的安全性如何?
我正在使用WPF应用程序，该应用程序使用EF 6和定义的连接字符串连接到Azure SQL(没有Web Service可以在运行SQL和Web服务器的Azure上省钱).
I am working on WPF app that connects to Azure SQL using EF 6 and defined connection string ( no Web Service to save money on Azure running SQL and Web server ).
所以我的问题是这样的连接有多安全?
So my question is how secure is such connection?
我的连接字符串为Encrypt = True(所以我正在使用SSL). 我正在使用AD用户凭据连接到数据库本身(AD用户和相应包含的DB用户的组合，不幸的是，用户名和密码在app的配置文件中). 我已经在Azure AD中注册了应用程序，并授予其使用此包含的数据库用户匹配的AD用户访问数据库的权限. (我正在使用此应用程序客户端ID来识别通信来自我的WPF应用程序.)
I have in connection string Encrypt=True ( so I am using SSL ). I am using AD user credentials to connect to DB itself ( combination of AD user and corresponding contained DB user, unfortunately username and password are in config files of app ). I have registered app in Azure AD and gave it permission to access DB using this contained DB user matching AD user. ( I am using this app client id to identify that communication comes from my WPF app ).
我在这里只能看到的威胁是，如果有人访问安装了应用程序的计算机，并从配置文件中检索建立连接并进行身份验证所需的所有信息.
The only threat I can see here is if someone gain access to computer with app installed and retrieves from config files all those information needed to establish connection and authenticate it.
但是我在网络方面真的很虚弱，我不知道有人能从窒息的网络流量中获取那些信息. (我自己尝试过使用wireshark，但对我来说一切看起来都很乱)
But I am really weak in networking stuff and I have no idea if someone can obtain those information from snuffing network traffic. ( tried to use wireshark myself but it all looked pretty gibberish to me )
所以有人知道如何以任何方式破坏这种通信吗?
So has anyone any idea how such communication can be corrupted in any way?
SQL Server和SQL Azure支持数据库连接的加密(动态加密).请注意，SSL是此术语的较旧术语-当前支持与SQL引擎(在任何情况下)进行通信的最佳功能是TLS 1.2.请注意，与SQL Azure进行通信时，您需要具有正确(最新)的客户端驱动程序版本，才能获得此安全性.使用这些驱动程序时，SQL Azure默认情况下会强制执行加密.您可以在这篇文章中阅读其当前状态: https://support.microsoft.com/en-us/help/3135244/tls-1-2-support-for-microsoft-sql-server
SQL Server and SQL Azure support encryption for database connections (encryption in motion). Please be aware that SSL is the older term for this - the current best capability supported to talk to the SQL engine (in either context) is TLS 1.2. Note that you need to have the right (up to date) versions of client drivers to be able to get this security when talking to SQL Azure. SQL Azure enforces encryption by default when using these drivers. You can read the current state of this in this post: https://support.microsoft.com/en-us/help/3135244/tls-1-2-support-for-microsoft-sql-server
关于更广泛的问题，编写应用程序(2层或3层)时，需要考虑很多事情.您应该查看Azure SQL DB上的防火墙以锁定启用的所有路径.您应该使用SQL权限模型来限制每个用户/角色在数据库中进行操作时可以执行的操作.您应该使用audit来跟踪谁(以及从何处)连接到数据库.您应该确保使用的是TDE(默认情况下，对于新的数据库，在SQL Azure中为TDE). SQL中还有其他安全功能，它们可能也对您有用(行级安全性，数据屏蔽，始终加密等).联网部分实际上只是设计安全解决方案的起点.
With respect to your broader question, there are lots of things you need to consider when writing an application (2 tier or 3 tier). You should be looking at the firewall on Azure SQL DB to lock down whatever path you enable. You should use the SQL permission model to limit what each user/role can do when operating in the database. You should use audit to track who connects to the db (and from where). You should make sure you are using TDE (on by default in SQL Azure for new DBs). There are additional security features in SQL that may also be useful to you (row level security, data masking, always encrypted, etc). The networking part is really just the starting point for designing a secure solution.