foreign and welcome to part seven in this series of securing fields in servicenow in this video we are going to take a look at column level encryption column level encryption is server-side encryption for string based Fields such as strings dates urls as well as for attachments the field values that are encrypted can only be accessed by users who have the necessary roles and users without the necessary roles actually don't see the field at all I'm only going to give you an introduction to this topic here this is actually quite a complex and big topic and there are three individual courses on column level encryption available on now learning that I strongly recommend that you take if you want to know more about this and learn how to implement it these three courses are actually part of a broader learning path on the servicenow Vault that goes a little bit deeper into other encryption and data privacy topics so the best thing to do is to get started with an example and let's learn together how we can set this up and test column level encryption all right for this example we're going to continue using the same table we've been using in previous videos in this series this cast table here which contains some vehicle data and in past videos we've been looking at ways in which we can secure this pin field right here so at the moment I'm logged in as the cars admin and I can see the field and I've got right access as well and the same is also true for our cause user he goes well I've got read and write access to this pin field okay so let's come back and our starting point is the field encryption module so this is something we need to create this is the framework for all the encryption that we are going to create here so I'll just go ahead and create a new record and we'll call this car pin codes okay no spaces are allowed in this name so that's why I've got the underscores there and I'll go ahead and select the default template for the cryptography cryptography specification all right so I will save that and once I do that I get this entry here and this crypto specifications related list this is actually the key that we're going to define various parameters for so let's go ahead and open that here basically just have to walk through this little guided setup of sorts to define the keys so I'm going to stick with the default algorithm here and click on next optionally we don't have to do this to specify a life cycle for the key that we're going to create so what we could do here is set the duration here to be one and the duration type to be one year and one year from or after and here for some reason we can't actually specify the activation date of the key so let's go into the record itself and we want the relative duration of one year after the activation date and just update it there okay so that's looking good all right so let's go to the next step again I'm just going to accept all the default values here for the key origin servicenow if you have the Enterprise version you can actually Supply your own keys but again this is something that we're not going to go into in this course this is something that is discussed in a little bit of detail in the courses on now learning so next all right so now we're done with our little Setup Wizard here and we'll go ahead and generate the okay so now we're back to the cryptographic module here and you can see here we now have one key that's been generated okay it's not active yet uh this cryptographic module lifecycle state is set to draft at the moment but we can change that to published and update that you can see also now that the key life cycle state has been automatically so it's active okay so the next thing we have to do is to come to our module access policies right here basically we need to assign a role to that cryptographic module that we just created so let's go ahead and create a new one we'll give it a name uh car pins for admins okay or for car admins okay and we'll select that cryptographic module again PIN codes is the one here we will select a role and the target role will be our cars admin user and we will set the result to track okay and then save that okay so this means now that if you have the car's admin role you've got access to that key to that cryptographic module that we've just created the next step now is to define the field that we want to actually encrypt so let's go to field encryption encrypted field configurations and we'll go ahead and create a new one all right so we are going to encrypt the column in this case here the table will be our cars table and the column will be the pin field okay and importantly the cryptographic module we need to specify that as well so let's do that one the PIN codes one and then we are ready to go now we're going to restrict this to a single module but you can actually specify more than one module here if you save this there will be related list that appears that basically gives you the opportunity to encrypt put that back in there uh encrypt a field with two different keys for two different roles so if I um right to that field with my key with my role um only users with that role will be able to see that value if you still have right access to that encrypted field but with a different encryption key you won't be able to see it but you will be able to see any changes or entries that were made with your own encryption key okay so again this is something that will go that we go into a little bit more in the now learning courses all right so let's go ahead and save that okay so we can now go ahead and test this I don't think we need to click on this schedule Mass encryption Job Link I read somewhere that once you set this up it will imply to Future records and changes but not to current records but in my testing uh that wasn't the case but we can check this now if I go back to my uh admin user still and look at this table if I just refresh this list here we should still be able to see the pin and all the values there if I open up a form we can see the pin field there you can see the little padlock actually that means it's encrypted now and I can go ahead and change that value uh to something else and save it and I should not have a problem with that because I have the car's admin role let's see what it's like now for the car's user so if I come back to the list and we'll just refresh this first of all we've got the pin at the moment I haven't refreshed the page since let's do that now okay so the pen field is still there okay um ideally we probably should get rid of it from the list layout but it's still there but you can see all the values have gone if I double click in there nothing happens okay if I open up a record however then we should not see that pin field at all it's gone all right and if I were to look at the source code for this page you know that pen field uh won't be there all right so for the cars user that feels encrypted it's for all intents and purposes I don't even know that that field exists apart from the fact that I saw it in the list layout and uh yeah so we should actually take care of removing that field so as not to make users lives more complicated okay so that's how you set up column level encryption quite easily and quickly in servicenow um as I said we started by creating a cryptographic module which then was associated with the key we then Associated that key with or that module with a particular user or role and then also to a particular field and then all those come together to encrypt the field for specific or encrypt the field but make it available for specific users only okay so this has been a very short summary of how to set up column level encryption again I would strongly recommend all of you who are interested in learning more about this feature who need to implement it need to plan it and then implements it to take a look at those courses on now learning because those courses go into much more detail than what we've been able to cover here in this short video okay you'll need also to plan your encryption because encrypting a field means that that's going to have an impact potentially on other processes either in terms of users or background processes flows scripts Etc that are relying on access to that field so you need to ensure that the processes that you've previously configured in the past are going to continue to work after you encrypt a field just a couple of notes on my own testing with flows and business rules when I created a flow to see if it had access to that data in that field if I ran that flow as a system user it failed but if I set the flow to run as the currently logged in user and that user had the necessary role to view that field that encrypted field then it worked just fine with business rules it's similar if the business rule has been triggered by a user who has a necessary role to view that field then that should work just fine maybe it's a best practice you could use the Glide system method has rolled to check if the user does have the necessary roles before you do anything else with that business rule but these are just a couple of very brief points to consider and there are other points that you'll need to look at and as I said Con level encryption is something that needs to be planned properly thought about looking at the consequences of doing that for reporting as well and so forth but I hope this has helped you in understanding column level encryption and securing your data in servicenow thank you for watching this video and maybe even if you have watched the whole series thank you very much and we'll see you in the next one bye for now