Data Gateway TCP security

[mcnallyd]

The documentation says that the Azure Datagateway transmits data from on prem to Azure with "Direct TCP".  There is a note that it can be configured to use HTTPS, but that this will significantly impair performance.

Does this mean that by default the TCP data transmission is unencrypted and thus insecure?

https://powerbi.microsoft.com/en-us/documentation/powerbi-gateway-onprem-indepth/

Thanks,

David.

[v-qiuyu-msft]

Hi @mcnallyd,

I already sent an email to the PG regarding this question, will update here once I get any feedback.

Best Regards,
Qiuyun Yu

[Greg_Deckler]

I believe the gateway uses TLS with the the direct TCP data transmission so it is encrypted. TLS is also used with things like SMTP, etc. In any event, the data is encrypted during movement, see the security whitepaper here:

http://go.microsoft.com/fwlink/?LinkId=829185

[mcnallyd]

Thanks.  We have put in place more stringent information security policies and so I am hoping to find some definitive documentation stating that TLS is used, and ideally what version.  I realize that the security whitepaper says that data in process is encrypted, but the comments about the performance hit from https raised a question during our security review.  If the Direct TCP traffic is already encrypted, why would anyone want to force https?

[v-qiuyu-msft · Accepted solution]

Hi @mcnallyd,

I got the information from PG , they said:

"It is indeed TCP over TLS.  You would normally only switch to HTTPS if your customer doesn’t want to open the required ports for TCP.

There is more information here:

https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-power-bi-security/

and in the Power BI Security Whitepaper here: http://go.microsoft.com/fwlink/?LinkId=829185"

Best Regards,
Qiuyun Yu