Skip to main content
Contact a Moderator

Question

4
Replies
290
Views
 Sandeep Ghosh (Sandeep_Ghosh) Scotiabank Lead System Architect
Scotiabank
CA
Sandeep_Ghosh Member since 2011 40 posts
Scotiabank
Posted: January 24, 2020
Last activity: July 6, 2020
Posted: 24 Jan 2020 12:59 EST
Last activity: 6 Jul 2020 5:24 EDT
Closed

Difference between Application and System data encryption

We are using Pega 8.3.

Under System -> Settings -> Data Encryption, there are two options, "Application Data Encryption" and "System Data Encryption". What's the difference between the two? I tried to find it in the documentation provided, didn't find a proper answer.

We want to use 'Attribute Based Access Control' to encrypt some properties, so which Data Encryption configuration should we update?

Regards,

Sandeep

Pega Platform Low-Code App Development Security
Moderation Team has archived post, This thread is closed to future replies. Content and links will no longer be updated. If you have the same/similar Question, please write a new Question.
Posted: 2 years ago
Posted: 24 Jan 2020 15:45 EST
Harish Gunneri (Harish_Gunneri) PEGA Senior Principal Engineer, Technical Support
Pegasystems Inc.
US

By default, the platform applies certain encryptions standards while storing the data to DB. However to apply additional layers of encryption OR use customer encryption types, one can use Data Encryption options. System data like passwords use System Data Encryption & Application Data refers to the case data. 

 

As you are requirement is about encryption some (individual) properties, you need to create an access control policy with PropertyEncrypt action.

Would recommend checking the below articles in detail.

https://community.pega.com/knowledgebase/articles/security/encryption-pega-platform

https://community.pega.com/knowledgebase/articles/security/encrypting-individual-properties-pega-platform

 

Let me know if that helps!
Posted: 2 years ago
Posted: 24 Jan 2020 16:10 EST
Sandeep Ghosh (Sandeep_Ghosh) Scotiabank Lead System Architect
Scotiabank
CA

Thanks Harish for your response! but my query was different. Even before we use access control policy rule with PropertyEncrypt option, we need to define what type of encryption and which cipher and keys needs to be used. It needs to be defined under System -> Settings -> Data Encryption landing tab.

When I go there I see two options "Application Data Encryption" and "System Data Encryption", It is not clearly described in community help that which one is responsible for ABAC PropertyEncrypt option (My guess is "Application Data Encryption").

Under "Application Data Encryption" there are two options "Platform Cipher" and "Custom Cipher". In our case, client does not have any Cloud KMS solution (AWS, Azure, Hashicorp etc.), So I am planning to create my own Java KeyStore (JKS) and store the AES 128 bit secret key there. As per Pega documentation (https://community.pega.com/sites/default/files/help_v83/procomhelpmain.htm#security/data-encryption/custom-kms-app-data-tsk.htm) I need to create a Data Page and populate the key in CustomMasterKey object from KeyStoreUtils. I followed all the steps i.e. copying the code snippet (step 2) from OOTB activity "pzSampleGetCustomMasterKey" and updating masterkeys/CDK etc. but when I am trying to create the keystore rule (using the Data Page), it throws error in log file. There is not much detail in the error message printed in the log file and engine API documentation is not detailed for "CustomMasterKey" class. 

Show More

Thanks Harish for your response! but my query was different. Even before we use access control policy rule with PropertyEncrypt option, we need to define what type of encryption and which cipher and keys needs to be used. It needs to be defined under System -> Settings -> Data Encryption landing tab.

When I go there I see two options "Application Data Encryption" and "System Data Encryption", It is not clearly described in community help that which one is responsible for ABAC PropertyEncrypt option (My guess is "Application Data Encryption").

Under "Application Data Encryption" there are two options "Platform Cipher" and "Custom Cipher". In our case, client does not have any Cloud KMS solution (AWS, Azure, Hashicorp etc.), So I am planning to create my own Java KeyStore (JKS) and store the AES 128 bit secret key there. As per Pega documentation (https://community.pega.com/sites/default/files/help_v83/procomhelpmain.htm#security/data-encryption/custom-kms-app-data-tsk.htm) I need to create a Data Page and populate the key in CustomMasterKey object from KeyStoreUtils. I followed all the steps i.e. copying the code snippet (step 2) from OOTB activity "pzSampleGetCustomMasterKey" and updating masterkeys/CDK etc. but when I am trying to create the keystore rule (using the Data Page), it throws error in log file. There is not much detail in the error message printed in the log file and engine API documentation is not detailed for "CustomMasterKey" class. 

I am not sure whats wrong with the configuration. It might also be a bug on the platform, then I will open an SR for that.


Show Less
Posted: 2 years ago
Posted: 24 Jan 2020 16:21 EST
Harish Gunneri (Harish_Gunneri) PEGA Senior Principal Engineer, Technical Support
Pegasystems Inc.
US

Yes, it has to be Application Data Encryption in your case. 

 

If there is not much of detail in the log file, SR must be a good path to confirm what's wrong.

 

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice