Raven DB 的文件系统是否已加密？
我只是想确定 Raven DB 使用的文件系统上的文件是否加密？有人可以打开文件系统上的文件并将它们直接从二进制转换为 ASCII，还是加密的？
我试图说服我们的管理层尝试一下 RavenDB，但他们对安全性感到担忧。他们给出的例子是，您不能只打开 MS SQL 数据库文件，将其从二进制转换为 ASCII，然后读取它。所以我想验证 RavenDB 是否也阻止了这种事情？
I'm just trying to determine if the files on the filesystem used by Raven DB are encrypted or not? Can someone just open the files on the filesystem and convert them from binary to ASCII directly, or are they encrypted?
I am trying to convince our management to give RavenDB a shot, but they have concerns about security. They gave the example that you can't just open up an MS SQL db file, convert it from binary to ASCII, and read it. So I am trying to verify if RavenDB prevented that kind of thing as well?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
好吧，我个人认为，如果你的管理层提出了这种稻草人的论点，那就很糟糕。
回答你的问题：不，你不能只用记事本打开 ravens 数据文件夹中的任何文件并期望看到有意义的内容。因此，对于那些不知道如何编程的人来说，是的，它们是加密的。
为了说服您的管理层，您可以告诉他们 raven 使用与 Microsoft Exchange Server 相同的加密算法。如果他们想更深入地挖掘，那就叫 Esent。
Well, personally I think that your management sucks if they come up with such straw-man arguments.
To answer your question: No, you can't just open any file inside ravens data folder with Notepad and expect to see something meaningful. So, for the ones that don't know how to program, yes they are encrypted.
To convice your management you can tell them that raven uses the same encryption algorithm as Microsofts Exchange Server does. If they want to dig deeper - it's called Esent.
RavenDb 存储未加密。可以用记事本打开，看到一些数据。同时我也不认为 MS SQL 默认情况下会加密文件。
RavenDb storage is not encrypted. You can open it with notepad and see some pieces of data. At the same time I do not think that MS SQL encrypts files by default either.
RavenDB 在 2012 年中期添加了加密功能。获取 RavenDB 的“bundle:encryption”，然后确保您的密钥在 .NET 配置文件或其他文件中正确加密。
http://ravendb.net/docs/article-page/3.0 /csharp/server/bundles/加密
http://ayende.com/blog/157473/awesome -ravendb-当日加密功能
RavenDB added encryption in mid-2012. Get RavenDB's “bundle:encryption” and then make sure your key is properly encrypted in the .NET config file or whatever.
http://ravendb.net/docs/article-page/3.0/csharp/server/bundles/encryption
http://ayende.com/blog/157473/awesome-ravendb-feature-of-the-day-encryption
SQL Server 2008确实具有加密功能，但您需要预先准备数据库实例以启用它，然后创建启用加密的数据库，然后存储数据。
如果没有，您可以将数据库从计算机上复制下来，然后在有权访问它的工具中打开它。
使用 RavenDB，您可以勾选该框并开始使用！ （尽管我不知道将备份移动到另一台机器并恢复它们的复杂性）。
就你们管理层提出的观点而言，这是一个相对毫无意义的论点。
如果您可以直接访问数据库的文件，那么游戏就结束了。 加密是你的最后一道防线。
[我不认为黑客会在记事本中打开 40GB 文件..那太愚蠢了:-)]
因此，不要以最坏的结果告终在这种情况下，您必须考虑可以实施的控制措施，以达到这种程度的关注。
您需要弄清楚某人如何访问该文件（以及与所有缓解技术相关的成本）：
物理访问
限制对服务器的直接访问可以减少窃取服务器的风险。您必须考虑所有预防控制（门锁、身份证、虹膜扫描仪）、侦探控制（报警系统、闭路电视）以及您想要花多少钱关于这一点。
这就是为什么云计算如此有吸引力！
访问控制
然后，您必须通过 RDP 进入计算机或通过 Active Directory 远程连接到其文件系统，以便只有少数人可以访问它 - 可能是 IT 支持和数据库管理员。作为管理员，他们应该在组织内受到审查和信任（通过信息安全治理框架）。
如果您还想进一步降低风险，也许可以像银行一样实施两因素身份验证，这样即使知道用户名和密码也无法访问服务器！
然后，您公司的员工就存在合法或非法访问它的风险。我的意思是，当用户无论如何都可以查询时，为什么要费尽心思去购买保安、狗和巨大的围栏呢！您只允许对数据的某些部分进行某些操作。
总而言之……“纵深防御”就是你的应对方式。总是存在可以识别的风险，但您需要考虑现有控制措施的数量，如果风险太高，则添加更多控制措施。但是，向您的组织添加更多控件通常会降低系统的用户友好性。
SQL Server 2008 does have encryption, but you need to prepare the DB instance beforehand to enable it, then create the DB with encryption enabled and then store data.
If you haven't, you could just copy the DB off the machine and open it in a tool that does have access to it.
With RavenDB, you can tick the box and off you go! (although I do not know the intricacies of moving backups to another machine and restoring them).
In relation to the point your management made, this is a relatively pointless argument.
If you had access directly to the file of a DB, it's game over. Encryption is your very last line of defence.
[I don't think hackers are going to be opening a 40GB file in Notepad .. thats just silly :-)]
So instead of ending up at the worst case, you have to look at the controls you can implement to even get to that level of concern.
You need to work out how would someone even get to that file (and the costs associated with all of the mitigation techniques):
Physical Access
Restricting direct access to a server mitigates stealing it. You have to think about all of the preventative controls (door locks, ID cards, iris scanners), detective controls (alarm systems, CCTV) and how much you want to spend on that.
Hence why cloud computing is so attractive!
Access Controls
You then have to get onto the machine via RDP or connect remotely to its file system via Active Directory, so that only a select few could access it - probably IT support and database administrators. Being administrators, they should be vetted and trusted within the organisation (through an Information Security Governance Framework).
If you also wanted to reduce the risk even further, maybe implement 2 Factor Authentication like banks do, so that even knowing the username and password doesn't get you to the server!
Then there's the risk of employees of your company accessing it - legitimately and illegitimately. I mean why go to all of the trouble of buying security guards, dogs and a giant fence when users can query it anyway! You would only allow certain operations on certain parts of the data.
In summary ... 'defence in depth' is how you respond to it. There is always a risk that can be identified, but you need to consider the number of controls in place, add more if the risk is too high. But adding more controls to your organisation in general makes the system less user friendly.