With the release of SQL Server 2016, the database engine has been greatly enhanced for security, with three new features you'll learn about in this demo-packed session. With dynamic data masking (DDM), you can fully or partially conceal sensitive columns from query results. Masking does not modify data on in the table, it simply hides data from users that don't have permission to see it. Row-level security (RLS) also hides data from unauthorized users, but at the row level. With RLS, you can create your own security policy to control which users can read or write specific rows in the table. Finally, Always Encrypted (AE) uses client-side encryption to ensure that data is encrypted in flight, not just at rest. Encryption keys are accessible only to the client. This guarantees that data can't be decrypted on the server, easing the migration path to the cloud for users with highly sensitive data.