Encrypting application data

To make your data more secure, you can select the type of encryption to use in your application to encrypt and decrypt passwords, properties, and BLOBs.

Access the Data Encryption tab by clicking Configure > System > Settings > Data Encryption.

The following options are available:

Application data encryption (exposed by default)

You can change the encryption type for your application at any time by switching between the platform cipher and a custom cipher.

• Platform cipher – The platform cipher uses the AES256-CBC with PKCS7 Padding cryptographic algorithm to encrypt and decrypt sensitive case data in your application. You need to use your own Customer Master Key (CMK), managed by your external key management service (KMS). The keys stored in AWS KMS support time-based and on-demand data key rotations. You do not need to create any custom cipher code for this encryption option.
  CAUTION:

  When changing the KMS keystore, you must activate the new keystore before you delete or disable the active Customer Master Key.
• Forced data key rotation – You can rotate the internal encryption key at any time. This is typically done if the Customer Data Key in the platform cipher has been compromised The key can be rotated regardless of the configured key rotation period in the keystore data instance.
• Custom cipher – The Custom cipher is used when the platform cipher does not suit your company’s needs. To use this encryption type in your application, you need to create your own custom encryption cipher. For more information, see Creating a custom cipher in Pega Platform.

  You can switch between the platform cipher and a custom cipher to change the encryption type for your application at any time.

  CAUTION:
  When you switch between cipher types, do not delete the original custom cipher or encryption keys. Deleting the previous custom cipher or encryption keys will make Pega Platform unable to decrypt previously encrypted data.

After you configure and activate the cipher, you specify the classes and properties to encrypt. For more information, see Encrypting the storage stream (BLOB), and Creating an access control policy for the PropertyEncrypt action.

Application master key usage history

You can see read only data based on the application data encryption settings, which shows activation and rotation history.

System data encryption (exposed by default)

Allows you to tell Pega what to use or who is providing the master for system data encryption. The only data that is encrypted is the session cookie. There are two masterkey providers:

• Pega Platform – Pega will generate the key for you.
• Keystore – You can provide your own key by specifying a key and selecting a keystore instance.

Master key usage history

You can see read only data based on the system data encryption settings, which shows the activation and regeneration history.

CAUTION:

Do not delete data from the pr_data_admin_sec* tables. Doing so might result in loss of encrypted data.

For more information about encryption, see Encryption in Pega Platform.