When it comes to security and encryption on the Now Platform, you've got plenty of options. But navigating these options can be tricky. Fortunately, ServiceNow is here to help. Join the webinar, and together we'll explore the various options for encrypting your data and determine which one is right for your organization's unique situation.

Originally aired: August 31, 2021 8:00 AM PT

Links Mentioned

Featured Experts

Chuck Tomasi is a Sr. Developer Advocate for ServiceNow. He is a computer science major with over 35 years of IT experience. As a former ServiceNow customer, Chuck won the first Innovation of the Year Award at Knowledge 10. Since joining ServiceNow in 2010 as a Technical Consultant, he has done many large scale ITSM implementations and custom applications, acted as an adjunct instructor for Education Services, created and lead the Technical Best Practices program, makes appearances on Live Coding Happy Hour, created dozens of fit for purpose custom applications, and co-hosts the ServiceNow series "TechNow".

Kreg Steppe is a Sr Staff Enterprise-wide Apps/Sys Developer within ServiceNow Training and Certification developing and supporting cloud training infrastructure. He specializes in developing integration solutions, automating repeatable processes and Cloud Management in ITOM. Kreg's prior experience includes operating his own ISP, developing web applications in PHP, network integration, managing network support, Application Development on cloud based networks, DNS and email server maintenance. He is a Linux enthusiast and enjoys Photography.

Jeremy Duncan is a Platform Architect on the Workflow Design Studio team at ServiceNow. Jeremy is an Enterprise Architect with over 16 years of IT and Service Management experience. His experience and certifications span across retail and manufacturing with focuses on hardware, software, and information security specialties and is a ServiceNow Certified Master Architect. He has done many implementations in both the Enterprise Federal and Commercial spaces since 2011 and brings a breadth of platform knowledge that aids him in sound architectural decisions. He achieved his B.B.A. at MTSU and majored in Information Systems. He spends his free time fighting crime as a volunteer certified police officer in North Nashville since 2012 and enjoys family time, camping, with his wife and kids!

Questions and Answers

Can customers specify their own Key Management Secrets Engine?

that is discussed, interested in your use case / how you would want this to work

Will the ServieNow staff have access to the keystore?

having a little trouble with this new interface. the short answer is no. we have a small number of SecEng HSM admins with administrative rights (no access to customer keystore) whose accounts are closely monitored. As the key-wrapping hierarchy slide show

what does the auto generate option do? can it create the key when the module is first used?

my understanding is if the key was generated in Safnet HSM it cannot be removed/exported. I am interested in this topic.

Correct, the HSM key at the root of key protection is not exportable

How compatible Edge and CLE are with Workspace

-- Purbali Paul Choudhury

there's some nuance here. over time this will improve, particularly in Rome for CLE_Ent.

is key rotation handled by the KMF

what is the difference between CLE with KMF with new Quebec platform encryption with KMF

-- Purbali Paul Choudhury

CLE with KMF, called platform encryption in Q, has key management and protection via KMF

Clarification: What is the default encryption option (Edge, CLE_Ent or DBE)?

when you say default, you have to opt-in to all of those options

does module access policy replaces having context for encryption

-- Purbali Paul Choudhury

the context concept for CLE still exists as a subset of the larger Module (specifically within the MAP)

Does the KMF Cryptographic Module require a separate install or plugin?

It is becoming OOB. you can also request it from Service Catalog

Is there any links that would help show some examples that would fall within the various buckets? To help us make those decision based on fit for risk examples.

could you elaborate? we're envisioning all sensitive and regulated data, but this is futures and yet to be implemented

Is there an option for no key management/no encryption? and What is the default key management option?

KMF is OOB in Q -- but you choose how and what to encrypt; there's nothing encrypted OOB

What are the implications of turning on at rest encryption on a SNOW instance when you have a fairly large footprint already at play?

our field security team specializes in helping you walk through these implications and your encryption options relative to the risk you're trying to manage. the final answer depends on which encryption option you go with and what version you're running on

Can you import a key from a Safnet/Gemalto Network HSM 6.x

Assuming these keys can be kept in an external vault (cyberark) ?

there's some nuance here. it depends.