Why would you use edge encryption over database encryption?

[aaron_anderson]

I have looked through ServiceNow's documentation and even dug through quite a number of community posts, but why would anyone consider edge encryption over database encryption?

1) Database encryption is free, edge is not
2) Everything is already encrypted with database encryption, with edge you can pick and choose some sensitive columns (why not choose to encrypt everything?)

3) Both support AES-128 and 256 keys

4) Edge encryption requires additional hardware and complexity that database encryption doesn't

5) Database encryption behaves a little nicer with reporting

Does anyone have any good use cases on why a company would choose edge encryption?

[Uncle Rob]

Database level encryption means ServiceNow employees can still see the data
Edge encryption means only those people within the customer's boundaries can ever see the data.

[aaron_anderson]

There's a plugin with platform encryption you can install that locks SN from accessing your instance.

[CMDB Whisperer]

Edge encryption prevents data in transit.  Database Encryption, Cloud Encryption, and Column-Level Enterprise Encryption (CLEE) all protect data at rest.   Database encryption is a good starting option for many customers as it is free and provides strong encryption to the entire database, as you mention.  There is some performance cost in using any encryption.  CLEE provides field-level encryption without the use of Edge Encryption, and without impacting reporting, but the level of maintenance and administration is greater than with Database Encryption. 

Why would you use something other than Database Encryption?  Because you might have specific regulatory requirements like FISMA that require you to have Customer Key Management and key rotation, which Database Encryption does not provide.

You need to have an even more compelling business reason to use Edge encryption due to the development and administration overhead and potential negative impacts to data access if not configured correctly.  These needs may vary from customer to customer, based on the data that they manage, and the laws of the countries in which they operate in and those they do business with.  Ultimately, Edge encryption protects data in transit, which make it an entirely different solution.  It means that if someone were to try to access the data in transit without authorization, they would not be able to, as the key itself is only accessible in the on-prem network.

Short answer to your question is that these options are all provided to meet a variety of different needs for different businesses with different operating constraints.