Exploring Database Encryption
Summarize
Summary of Exploring Database Encryption
ServiceNow provides database encryption (DBE) and full-disk encryption to help customers meet statutory data protection requirements by securing data at rest. DBE uses symmetric AES-256 encryption to protect all stored data in real time, whether the database is online or offline. This encryption is transparent to users and does not affect functionality, with a minor performance impact of up to 5% during instance cloning. Full-disk encryption safeguards offline data against disk loss or theft.
Show less
Starting with the Washington DC release, Database Encryption is being phased out in favor of Cloud Encryption with Key Management, which will replace DBE for data-at-rest encryption.
Key Features
- Real-time AES-256 encryption: Encrypts data as it is written to the database and decrypts it in memory while accessed, supporting all stored data including activity log files.
- Encryption transparency: Users experience no loss of functionality; applications always access data in decrypted form for normal operations.
- Complete coverage: All instances, replication traffic, and backups are encrypted.
- Three-level key hierarchy:
- Customer-specific AES-256 key encrypts data.
- Second customer-specific AES-256 key protects the first-level key.
- Third AES-256 key, stored in FIPS 140 validated key management appliances in ServiceNow datacenters, protects the second-level key.
- Customer Controlled Switch (DBE with CCS): Allows customers to supply their own keys for encryption, encrypting all data at rest without affecting functionality.
- Support limitations: Database Encryption is not supported for on-premise instances.
What Customers Can Expect
By enabling Database Encryption, ServiceNow customers can ensure comprehensive protection of their data at rest to meet compliance and security needs, without sacrificing application performance or user experience. Data is securely encrypted both online and offline, with built-in key management ensuring robust security. Customers using cloud instances can implement DBE or opt for customer-supplied keys for added control. However, customers should plan to transition to Cloud Encryption as DBE is being deprecated in upcoming releases.
ServiceNow® offers database encryption (DBE) and full-disk encryption methods for customers with statutory obligations for data protection which may require at-rest protection for all data.
Database Encryption enables all data to be protected with symmetric AES-256 encryption, whether the database is online or offline. From the ServiceNow AI Platform perspective, all data flows in decrypted.
- Database Encryption supports all stored data to be encrypted in real time providing protection for data online and offline with no loss of functionality.
- Full disk encryption protects offline data if there is disk loss or theft.
With Database Encryption, all stored data is encrypted and individual records or tables are decrypted in memory while being accessed. New or changed data is encrypted as it is entered into a table and associated activity log files (bin, redo, undo, and error) are also encrypted.
Database Encryption is transparent to users, with no loss of functionality. When using this feature, all instances are encrypted, along with replication traffic and backups. Instance cloning is still available with a minor performance impact for using Database Encryption of up to 5%. Both new and existing instances on supported releases of the ServiceNow AI Platform can take advantage of database encryption.
As illustrated, ServiceNow stores and manages keys using a three-level key hierarchy:
- A customer specific AES-256 key is created by the database engine and is used to encrypt the data.
- A second customer specific AES-256 key is created by the database engine and is used to protect the first-level key.
- A third AES-256 key is created by and stored within FIPS 140 validated key management appliances in the ServiceNow datacenters. This key protects the second-level key and is unique per customer instance.
The ServiceNow AI Platform also supports database encryption with a customer supplied switch, DBE with CCS. This is an encryption solution that encrypts all data-at-rest when not in use in the database. It uses industry standard AES encryption with no impact to functionality. The database encrypts data as it is written to the disk, and decrypts data as it is read from the disk. That means that applications always have the data in an unencrypted state to perform the necessary logic and functions without impact.
If you are using your own keys for database encryption, see Database Encryption with Customer Controlled Switch.