Column Level encryption

[pavanvatt]

We are using Column Level encryption to encrypt data, string field, attachment. 

As part of this we created encryption context, then applied on Incident form for Short description and Description field. Once the context is applied, then user with role only able to access these field but not other users.

Looking for a way we can show the fields when any user click on "Create New" but after submitting ticket, then want to hide fields using column level encryption based on roles.

Also any best practice of doing column level encryption.

[Ragini Kukade]

Hi,

Hope the following information will help you

Column level encryption Usage and restrictions:

When you want to process sensitive data sets in the ServiceNow environment, you can use column-level encryption. The data is only decrypted when it’s viewed by a user with a role that is assigned the encryption context. This encryption is maintained throughout the backup process.

With column-level encryption, you can also apply the same encryption to attachments uploaded by users that you can apply to individual fields.

Controlling access to sensitive data often means limiting access either to a select group of users or granting it on an as-needed basis. Using role-based access control in conjunction with the column-level encryption feature ensures access to specific fields or attachments is only granted to the users who are assigned the appropriate roles.

Currently, ServiceNow does not support indexing or scheduled reporting data that is encrypted using column-level encryption. This is due to the nature of the data and ACL restrictions in the encrypted context; system accounts do not have access to encryption contexts.

Mark it as correct/helpful,if it helps.

Regards,

Ragini

[pavanvatt]

This information is good and already referred. Particular question on top on this documentation is once data is encrypted using column level encryption, then non-role user can not see them across instance. Please see below use case and let us know best way to address this. We reached Hi and response reach out to community for more help. Hence reaching out for other wider experience.

Use Case:- Using column level encryption we encrypted Short description, Description on Incident Form and encryption context is given to Role "ABC". ABC is the only role user who can see Short description, Description. This is good!! now the trouble come with users who don't have "ABC" role, they can't see Short description, Description on Incident Form. But for past few months/years they are seeing them on the form. How do we show these fields again?

Have anyone come across this situation and How is it addressed??

[mikeadler]

Hi Pavanvatt,

Great question. As you might have already concluded, both read access and write access to data encrypted with column level encryption are restricted to a user that has access to the encryption context applied to encrypt the data. There are no half-measures available. Therefore, the user either has access to the encryption context or the user does not to perform these operations on the data configured for column-level encryption.

That said, if some or all of your recent use case entails actually making that encrypted data available to a user that does not have the encryption context, then using the mass decryption feature for column-level encryption might be something you wish to consider for your purposes. This may or may not be directly applicable but it is worth considering in my opinion if one of your goals is to show the fields again, effectively removing column-level encryption being applied again to that previously set of encrypted data.

Could you please kindly indicate here in this particular response if it was somewhat helpful and/or correct in your reply?

Kind regards,

Mike

[jeremymatthew]

Hi Pavanvatt,

not sure if you've resolved this. I'm assuming you want to decrypt the data? If so, you need to assign ABC role to your self, log out and back in again, elevate role to security_admin and go back to the encrypted field configuration and click on the related link to decrypt. Once decrypted, everyone can see the data.

If you want everyone to view the data without assigning the role then maybe encryption isn't what you should be using but ACLs to control access to the fields.

Regards,

Jeremy