well good morning good afternoon good evening everyone thank you all for joining our platform privacy and Security Academy session I'm super excited to welcome you all to learn more about today's topic around how to protect your sensitive data with Cloud encryption my name is Fergus Saleem and I'm a uh outbound PM in platform security team I'm also joined by Kathy as a guest speaker who is our main pm and lead on cloud encryption related products in our work in this session we would like to cover how to protect sensitive data in your organization with Cloud encryption and highlight some of the key product capabilities along with some use cases and the demos before I hand it over to Kathy I would like to highlight one more important thing to let you let everyone in this call to be aware of as always we have to start by reminding you that we might talk about things that are on the product roadmap and since we are publicly relate traded company There are rules about making forward-looking statements so we just want to remind you to keep please make your purchasing decision based on the product as it exists today with that without any further Ado back to you Kathy great so for our agenda today I'll talk about um the service now Cloud encryption product and then I'll pass the microphone back over to furcon and he will talk about resources it will go through a q a and just by the way one of our other colleagues uh Jared is on the call with us he will be modern I mean the chat messaging so feel free to use the chat functionality and we'll be answering he'll answer some of those questions uh during the seminar in chat and we'll answer some of them also in the Q a and then there will be a survey at the end so for cloud encryption it's um a similar product to another item in our portfolio database encryption so database encryption has been in the servicenow portfolio for a while and uh the on the challenge with that is it's limited to only working with the Maria DB database and servicenow wanted to find a performance solution that could work with multiple databases not just Maria DB but other databases as well so not to tie ourselves to just one specific database technology and our solution that we've come up with is called Cloud encryption with key management and amazingly there are two parts to it there's the encryption part and there's the key management part so the encryption part we use the native Linux approach to provision volumes then volumes that are secured with the Linux unified key setup the abbreviation for that is Lux so we're just taking advantage of native Linux capabilities we're not doing anything super crazy or proprietary there um the key management part of things we're leveraging services within service now so we didn't have to re-implement that the KMS is the key management system and the lib kmf the library that is Key Management framework and we're using both of those for our Key Management Services that includes things like logs about key access and the ability to have two different types of keys the servicenow manage key or customer manage key Cloud encryption was launched in the San Diego family release so it has been available for about a year the common use cases for cloud encryption are where a customer has a lot of data in their environment that's considered sensitive and could potentially be a needed to be protected due to regulations or other types of business changes another common use case is where one wants to protect information but it's critical that functionality is not impacted there's other products within our portfolio that encrypt Fields but then other functionality like workflow or reporting could possibly be impacted so this is a product that does not have that type of impact on workflow reporting things of that nature it's also a common use case to use cloud encryption when application to your encryption is not necessary the product can be used with an application to your encryption product for example com level encryption Enterprise can be used with Cloud encryption they don't interact with each other they can be used to have layered security it's certainly a fine option but those are the three most common use cases for the features and benefits of the product there are again two types of keys the servicenow manage key which we would create and and manage on behalf of the customer or the customer manage key you have the flexibility to choose one or the other you can switch back and forth there's no limit to how many times you would switch back and forth most people will pick one and stick with it but um there's there's no restriction there on key type choice on key rotation again it's customer's choice on when you would want to rotate your key many customers rotate about once a year sometimes there's reasons to to rotate the key more frequently but we do have the key rotation capability for both servicenow manager key and customer manage key and again no no limitation no restrictions in the software once a year does tend to be a common best practice for key rotation when you look at the UI the user interface for cloud encryption key management you'll see three sub items the first mean Key Management operations that's where people will spend probably most of their time that's where there's a list of the keys they're being used for cloud encryption and also historical information about those keys the second option the key management transactions says details about a specific key and then the third item which is coming in in the Utah release in a couple of weeks is the scheduled key rotation settings so you can set a time for rotation like every six months every year and for the service now manage key since service now generates that we will actually then do the rotation for you for customer managed key we don't have the key so we're sending out a reminder to say Hey you set up a schedule to rotate your key every six months it's now time to do that please give us a new key so in addition we have a couple additional options if you choose customer manage key again these are not available yet these are targeted availability in Utah in a few weeks and they're only for customer managed Keys these are not available with the service now manage key so for cloud encryption you can have a functionality called Cloud encryption withdrawn resupply it's a separate skew it's an additional SKU and it's obviously an optional SKU there is an additional fee involved and customers will hold their key in their environment and if they want to withdraw that key that's fine the key is withdrawn and the instance will automatically start a shutdown operation so the database incidents will be closed it'll be in an encrypted state it won't be accessible by anyone so that means yes not accessible by service now and also not accessible by the customer or anybody in your organization so it is a pretty drastic operation we do note that the customer has to agree that they are solely responsible for the protection of their customer managed key and service now is not going to have any liability if you can't find and maintain your key so can be an important use case for some customers with that responsibility comes a lot of risk so we're just making it explicit that the risk does fall on the customer's shoulders um as an additional subpoint of withdrawn resupply as the withdrawal operation can cause such a drastic change as in the instance it's not going to be available we do have an additional option in the withdrawal function called Quorum control that would prevent one administrator either by accident or maliciously starting that cmk withdrawal function um that involves having a group of folks that the administrator says are people that would be potential approvers and then noting that the number of that group of approvers so say there's six approvers and four of the six a perverse must agree that the withdrawal option should start and then there will be a process to contact them and have that either approved or denied so very specific features only for um for the customer Advantage key available in Utah um so you'll be hearing more information about that as the Utah release is publicized more and I need to get my slide to move forward there we go okay we're now off to dental time so hang on one moment I'm going to stop sharing this screen and I'm going to share another screen okay let's go to screen share all right so this is a sample instance that we have and we're gonna get ready and we're gonna start going to Cloud encryption key management and specifically I'm going at the first item here Key Management operations you can see here that there is a list of keys many of them are the the ones that have already been in existence and are rotated but then we have the one key that's active the one that's on top that happens to be a servicenow key um it was created on uh March 8th I and we're gonna just click into this key Alias to get a little more detail on this key again it's the active key and the origin is servicenow and other information like algorithm and key size are noted here so I've been using this key for a few days again this is not not the ideal situation because it should be about a year but let's say I do decide I need to rotate this key so I click rotate key I get a pop-up message that says you are about to rotate your key just to make sure I could obviously cancel it if I needed to but I do want to rotate the key so I'm rotating it I get another message that says your request has been submitted please check the transaction section for updates so I'm going to just reload and get this going oh well but now it's not going to reload on me hmm okay let's see if I can get to reload again okay let's go one more time [Music] all right and I'm rotating the key and now reloading it yep okay so the rotation is completed which is great so now we can go back and we can see we have the rotated key but now we have a new active key from the 15th so that's all great now we have a new active key um and now I'm going to going to switch to customer manage keys I'm not going to use a service now manage key anymore I'm going to switch to customer manage key click that link read my information box that says I'm about to switch um I'm going to have to upload a wrapped customer mounters key and then keep going with the process yes I do want to do this I don't want to cancel so I get my wrapping certificate I've downloaded that I read the information that's in the documentation about how to prepare my key and now I'm going to browse and get my key which is there so that's all fine and then I can switch to customer manage key again the request was submitted check the status make sure that it's okay relive my form and the rotation is completed so we are all good to go and if we look at our Key Management operations we're back we're to a customer supplied key as the active key so that is the end of this part of the demo and now I'm going to share my screen again second sugar screen and we will move forward to a preview of the scheduled key rotation this again is functionality that is targeted to come out in the Utah release in a couple of weeks so you know just be clicking on this item in the UI the third Sub menu item schedule key rotation settings you'll come to this page that says once enabled you can schedule your key rotation reminders click the little check box that says enable scheduled key rotation which will bring up a number of other fields like how many months do you want to have between your key rotations minimum number is one maximum is 60 months which would be five years and 12 is the default number for the um the default value for that field and then uh one needs to fill in the day of the week to send the rotation reminder um so uh perhaps people want to only have those things on a weekday or only on a Tuesday or whatever it happens to be so that that would be um the field to to note that information this field will get calculated then and there will be uh the date that you'll get the reminder um and that would be you know calculated Again by by the software it's not something that you need to fill in and then you just hit submit over here and then you're all set so pretty seamless pretty fast to set it up if you decide to use scheduled key rotation um for the servicenow manage key again we will notify you a week in advance and say Hey you know you're coming up on the time that the key is scheduled to be rotated we're going to rotate in a week just wanted to let you know and if you are using customer manage key this will be a reminder saying you scheduled the key rotation to happen every 12 months it's almost that time um you need to provide us with a new key just reminder so that is that functionality I will now pass the microphone over to forgot to go through our resources information thank you so much Kathy it's a really wonderful demo I appreciate it if you have any other questions regarding to uh some of the highlights and some of the demo that Kathy just highlighted in this presentation feel free to ask your question through Zoom chat and we'll be addressing your question shortly in our q a session as well so I like to talk a little bit about what's available in our platform privacy and security uh team that we are providing you currently and we have our YouTube channel uh I will add all the links to the zoom chat right now so that you can click and watch our previous video that we recorded so far as well as some of the incoming video that we're producing in the future as well and also we have our own page on LinkedIn and Facebook and Instagram as well as we have our own podcast as well that you can follow simply by typing servicenow and also we have a now now learning on demand course as well so that you can learn some of the uh platform privacy or security related products especially around the Vault area as well as some other other components as well and also we have a documentation that we have a data sheets we have first call Deck and some of the product documentation and as well as we have a servicenow community page that we built recently for you so that you can get yourself up to date with all the contents around all the products that we provide as well as some of the incoming agenda and topics that we are hosting as part of this Academy session as well last but not least we however servicenow.com if you really wanted to learn about deeper around some of the the cloud encryption technology or if you want to read some of the Articles or if you want to learn more about Volk as a product with all the different components you feel free to go to servicenow.com and simply type by service now old you'll be you'll be seeing more contents there as well the second that I'd like to highlight is we have our knowledge session coming up in May 15 to 19 so if you're interested in signing in please register or knowledge session where we'll be hosting some of the presentation and the demo along with all the different use cases around our platform privacy and security area as well the last but not least uh these are the high uh the incoming agenda of what we will be hosting around uh platform privacy and Security Academy session as you're aware that we're just hosting uh the intro to service network encryption in this session as well as in May 10 we'll be having protect employee and customer uh personal information with servicenet data privacy and the June 15 we'll be having protect servicenow platform with Vault and August 15 we'll have managing the now platform easily and practically with your log Analytics tool and the September 15 will be hosting exploring the benefits and the challenge of Claude identity and access management and also be having another other topics down the road as well so if you're interested in you'll be reached out to uh through the registration link via email or you will find the rest nutritional Link in our platform privacy and security community site that I just shared on the zoom chat as well with that I am going to jump to q a session so if you have any other questions related to overall the product that we're uh building here as well as some of the content that just Kathy just shared around the cloud encryption and key rotation key rotation of functionality that is coming as part of Utah release feel free to ask your question through Zoom chat will be uh happy to answer as well hey while we went for that to come in uh Kathy I have one that I have seen out around the community uh regarding existing database encryption customers and uh what's what's up with migrating to Cloud encryption uh is that is there a sense of urgency um is it is it a painful process what's right so for database encryption customers um if the product is serving folks well there's no urgency to have to make a change um there have been some customers that have explored the option that we do have for database encryption for customer key which is called database encryption with customer controlled switch and that particular functionality requires people to build a Gateway on their own premise have a some development work needed and not all of our customers have developers uh in-house or they have other projects that they want the developers to be working on and not necessarily work on this integration enhancement for database encryption so if somebody has explored database encryption with customer control switch and didn't decide to go down that path because um of the implementation required I would definitely encourage them to to look at the cloud encryption product as customer managed key is much simpler it's uh the the interface is quite intuitive it's easy to manage there's nothing that you would need to build on your side so um that would probably be the use case that would be of most interest to change if uh if somebody is having other concerns with database encryption I'd be happy to hear about what the challenges are thank you yeah sure that will help me as I get that question um when I'm out there out there in the world customers and potential customers no worries great and then I guess I I do have a follow-up if nothing else uh is gonna touch and land in front of it uh let's say I am a customer and I find out about this and say I want this I need it tomorrow uh and I buy it and I request it is is it it's it's fairly straightforward as an install but I don't believe it's uh you know I don't think it's a two-day turnaround time I think there's some work on our data center side uh what's your estimated yeah time to implement this yes you're right so the the machines that we use to host Cloud encryption are different than the machines we use to host other instances so we do have to make sure we have the right type of machines available for instances moving to Cloud encryption or um instances being spun up for cloud encryption so if it's a new customer it's uh it's not a a big wait time because we do have spare capacity for new customer onboarding it's more of a challenge with current customers who decide they'd like to move to Cloud encryption as some of our customers have quite large databases and it's not just a five second thing to be able to move a large database from one machine to another machine so there is um there is a process involved for the um current customers that does it take some time we've been working to reduce the the time lag between when we have the order and when we can actually make the machines ready um for smaller customers it is on the order from you know a few days to a few weeks for larger customers it can be you know a month or so kind of thing we try not to have things linger longer than that but our worst case scenario we say 60 days I I've not had any customer being here that 16 day Mark but yes you do need to plan ahead if you're going to move to Cloud encryption and you are a customer with super large databases that's a great answer okay there's one question on the zoom chat Marco in case customers want to schedule a key rotation for their customer managed Keys is it necessary to upload a new key beforehand um no so if you're using the scheduled key rotation functionality what we'll be doing is we'll just send a reminder saying hey you scheduled a key rotation reminder to come to you once every whatever six months 12 months um so it's time and then uh the process that will happen is the customer will just go through the same process that they did when they uploaded their customer managed key the one I I demoed get the wrapping certificate wrap your key and upload it to the through the interface um it's not something that would uh have to be done in advance you don't have to Stage it just to get it um uploaded at the time that you wanted the rotation to happen yeah great okay well if there is no other question then I will uh give my thanks and appreciation to the audience thank you so much for for joining for our chat today thank you all appreciate it for your joining and feel free to register to our YouTube channel as well as uh get all the content to our community site as well it's time stay tuned bye-bye