Exploring Column Level Encryption
Summarize
Summary of Exploring Column Level Encryption
Column Level Encryption in ServiceNow Zurich allows you to encrypt specific database fields and stored files within your instance using AES128 or AES256 encryption algorithms. Encryption is managed viaencryption contexts, where you define what data to encrypt, select the encryption algorithm, and provide the encryption key stored securely in your instance. Access to encrypted data is controlled by assigning users to roles associated with these contexts, making role management a critical aspect of securing encrypted information.
Show less
Key Features
- Role-Based Access: Configure access to encrypted data based on user roles, ensuring only authorized individuals can view or modify sensitive fields.
- AES Encryption: Supports AES-128 and AES-256 algorithms for strong data security.
- Module Access Policies (MAPs): Create up to 5 modules and MAPs in the standard version to extend access controls, including considerations for system users and scripts. The Enterprise version supports additional modules and MAPs for more granular controls.
- Field Type Support: Standard encryption covers string, date/time fields, attachments, and URLs. The Enterprise edition extends this to HTML, Journal, and Translated fields.
- Equality Preserving Encryption: Enables encrypted fields to support equality comparisons and group-by operations by maintaining consistent encrypted values for identical data. Non-deterministic encryption is not supported.
- APIs for Encrypted Fields: Use
getDisplayValue()andsetDisplayValue()APIs to retrieve and insert cleartext and encrypted data programmatically, with enhanced API support in the Enterprise edition. - Key Management Features (Enterprise): Supports automated key rotation schedules, full lifecycle management of encryption keys, customer-supplied keys, ephemeral cryptographic keys for session-specific security, and secure key exchange between instances.
Cloning and Key Exchange
When cloning an instance with Column Level Encryption enabled, encrypted data and modules are copied; however, the encryption keys are re-encrypted with a source-instance-specific secondary key. This means the cloned instance cannot decrypt the data until a key exchange is performed. Until then, encrypted fields appear empty or unreadable, which is expected behavior and not data loss.
Practical Guidance
ServiceNow provides a guided tour covering the setup process for encrypting table fields or attachments, including creating Field Encryption Modules, Module Access Policies, and Encrypted Field Configurations. This tour offers links to detailed documentation and training courses, helping administrators and developers implement Column Level Encryption effectively.
Learn more about Column Level Encryption.
Column Level Encryption overview
Column Level Encryption is a base system feature that permits encryption of data stored within an instance using AES128, or AES256.
Column Level Encryption enables you to encrypt selected database fields and stored files through the use of encryption contexts. In these contexts you define what is encrypted, choose which algorithm to use, and supply the encryption key, which is stored within your instance.
After the context is created, you can associate it to a user role. Users assigned to this role, either directly of through a group, are able to access the encrypted data.
Because Column Level Encryption bases access to data on role assignment, it’s important to be familiar with administering roles on your instance. For more information, see Managing roles.
Field Encryption benefits
| Benefit | Feature | Required Roles |
|---|---|---|
| Configure access to your encrypted data based on assigned user roles. | Role-based access to encrypted data | security admin |
| Protect your data using the Advanced Encryption Standard (AES). You can choose to use either the AES-128 or AES-256 encryption algorithms. | AES Encryption | security admin |
Create up to 5 modules and module access policies (MAP)s using the standard version of Column Level Encryption. MAPs expand on role-based access to allow considerations for:
|
Support for up to 5 modules and module access policies (MAP)s | security admin |
| Encrypt common field types using the standard version of Column Level Encryption. Column Level Encryption Enterprise supports additional field types. | Encryption for String text, Date and Date/Time fields, attachments, and URLs | security admin |
| Choose between standard and equality preserving encryption. When enabled, equality preserving encryption ensures that the encrypted value of a field is the same when the field value remains the same. This type of encryption
enables equality comparisons and group by operations on a field. Note: Non-deterministic encryption isn’t supported. |
Equality preserving encryption support | security admin |
Use getDisplayValue() and setDisplayValue() APIs to return cleartext values and insert encrypted data for encrypted fields. |
getDisplayValue() and setDisplayValue() APIs |
security admin, developer |
Column Level Encryption Enterprise benefits
Column Level Encryption Enterprise builds on the existing Column Level Encryption framework and provides these additional features after you purchase a subscription.
| Benefit | Feature | Required Roles |
|---|---|---|
| Encrypt additional field types. | Support for additional field types:
|
security admin |
| Column Level Encryption Enterprise supports more than 5 modules and module access policies to provide more options for access to secured data. | Support for additional modules and MAPs | security admin |
| Keys from a key vault can be rotated on an automated schedule you configure. Using automatic key rotation can improve security while reducing administrative overhead. | Configurable automatic key rotation | security admin |
| Manage the full life cycle of your data encryption keys. Optionally, you can securely exchange data encryption keys generated within your environment. | Customer supplied keys | security admin |
| Ephemeral keys are cryptographic keys that are generated for each execution of a cryptographic process. These keys more secure because they’re generated for use in a single session. | Ephemeral cryptographic keys | security admin |
Updated setDisplayValue() and setDisplayValue() APIs can insert encrypted data for encrypted fields. |
Updated getDisplayValue() and setDisplayValue() APIs |
security admin, developer |
Cloning considerations
When you clone an instance that uses Column Level Encryption, the encrypted field data and encryption modules are copied to the target instance. Because encryption keys are re-encrypted with a secondary key that is unique to the source instance, the target instance can't decrypt the field data after cloning.
Until a key exchange is performed, encrypted fields on the cloned instance appear empty or unreadable. This is expected behavior and does not indicate data corruption or loss.
To restore access to encrypted fields on the target instance, complete a key exchange from the source instance. See Configure Key Exchange.