In recent releases of SQL Server, the database engine has been greatly enhanced for security, with three new features you'll learn about in this demo-packed session. With dynamic data masking (DDM), you can fully or partially conceal sensitive columns from query results. Masking doesn't modify data on in the table, it simply hides data from users that don't have permission. Row-level security (RLS) also hides data from unauthorized users, but at the row level. With RLS, you can create your own security policy to control which users can read or write specific rows in the table. Finally, Always Encrypted (AE) uses client-side encryption to ensure data is encrypted in flight, not just at rest. Encryption keys are accessible only to the client. This guarantees data can't be decrypted on the server, easing the migration path to the cloud for users with highly sensitive data.