Column Level Encryption vs Platform Level Encryption differences

[ashishnow]

As we are all aware that "Column Level Encryption (CLE) is replaced by Platform Encryption" 

However customer still has a choice to either go with Column Level Encryption (CLE) or Platform encryption (PE). 

can anyone please share primarily difference between the two so we can take the right decision if CLE or PE is a better choice?

Thank you in advance!

[Ashish Nahar · Accepted solution]

Encryption (Column Level): Product Documentation: Orlando Release

Encryption Support

Encryption Support, also known as column-level encryption, is a built-in feature which permits encryption of string, Date, Date/Time, or attachment fields using AES-128 or AES-256. You can encrypt existing non-system string fields or add new fields to use for encryption.

Implementation of column-level encryption begins with defining one or more encryption “contexts” in your instances of the Now Platform. This process includes selecting the desired encryption algorithm and providing an appropriate secret key. Access to data later encrypted using the feature is role-based, with contexts being associated with roles. Users without the correct role don't see the field at all, or if they are assigned a role with a different context, a blank field appears. Figure 1 illustrates how role-based encryption is enabled.

Figure 1 – Role-based encryption example

Platform Encryption: Quebec

https://docs.servicenow.com/bundle/quebec-platform-administration/page/administer/now-platform-encryption/concept/now-platform-encryption.html

Column Level Encryption and Platform Encryption

Platform Encryption with the Key Management Framework offers an alternative encryption solution to you compared to Column Level Encryption (CLE). See Understanding the Key Management Framework for details on how Platform Encryption with KMF compares to CLE.

See Cryptographic purpose, algorithms, and key information for encryption/decryption algorithms supported.

KMF in Platform Encryption vs. CLE (with encryption contexts)

Column Level Encryption (CLE) specifies encryption contexts for the creation of encryption keys. Contexts assign based on role to uses. These encryption contexts provide only rudimentary key management capabilities.

Platform Encryption is the successor to column level encryption using KMF and its full support of key management functions. Specifically, Platform Encryption utilizes KMF’s cryptographic modules, granting you more control of server-side encryption. KMF ensures proper data encryption key protection using key hierarchy and envelope encryption. Cryptographic modules use specifications and access policies with lifecycle management control over the key for the module, whether it's a ServiceNow key or your own customer supplied key.

The Encrypted Field Configuration form is used in both. With Platform Encryption, you choose the type of encryption: column encryption or attachment encryption.

• In the CLE model, encryption is performed via encryption contexts. Each context is mapped to a role, which is mapped to a user.
• With Platform Encryption, your instance encrypts data through cryptographic modules that you configure. You can create an access policy for each module based on role or resource exchange. See Understanding the Key Management Framework and Cryptographic module overview for an explanation of what modules are and how they work. See Create a cryptographic module and Create module access policy for instructions.

[ashishnow]

Thank you Ashish, this is helpful.

Ashish thanking Ashish 🙂

[Ashish Nahar]

🙂 No Problem

[John Zhang1]

Platform Encryption was introduced via Quebec release.  I see the following difference between two type of  Encryptions

1) Platform Encryption- is enabled by the Key Management Framework (KMF), which lets you protect data in your instance with encryption, access control, key life cycle management, and use the updated Password (2-Way Encrypted) field type to encrypt and decrypt custom fields, which are now enabled by the Key Management Framework’s key life cycle management and key protection.

Platform Encryption gives you increased control over: Fields: Encrypt more fields than with standard encryption (ex: most custom text, url, email, phone and date fields and some standard fields are available). Decrypt fields when needed. Files and attachments: Added capability to encrypt your documents

2) Column Level Encryption (CLE) - following post have the answer you need.

Does Column Level Encryption encrypt data at database level?

Column Level encryption

Please mark reply as Helpful/Correct, if applicable. Thanks!