{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41174,"path":"platform-security/exploring-column-level-encryption.md","title":"Exploring Column Level Encryption","bundle":null,"doc_type":null,"release":"australia","body":"\n# Exploring Column Level Encryption\n\nLearn more about Field Encryption.\n\n## Column Level Encryption overview\n\nColumn Level Encryption is a base system feature that permits encryption of data stored within an instance using AES128, or AES256.\n\nColumn Level Encryption enables you to encrypt selected database fields and stored files through the use of encryption contexts. In these contexts you define what is encrypted, choose which algorithm to use, and supply the encryption key, which is stored within your instance.\n\nAfter the context is created, you can associate it to a user role. Users assigned to this role, either directly of through a group, are able to access the encrypted data.\n\nBecause Column Level Encryption bases access to data on role assignment, it’s important to be familiar with administering roles on your instance. For more information, see [Managing roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/ua-creating-roles.md).\n\n## Column Level Encryption benefits\n\n<table id=\"table_hb1_1br_ryb\"><thead><tr><th>\n\nBenefit\n\n</th><th>\n\nFeature\n\n</th><th>\n\nRequired Roles\n\n</th></tr></thead><tbody><tr><td>\n\nConfigure access to your encrypted data based on assigned user roles.\n\n</td><td>\n\nRole-based access to encrypted data\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nProtect your data using the Advanced Encryption Standard \\(AES\\). You can choose to use either the AES-128 or AES-256 encryption algorithms.\n\n</td><td>\n\nAES Encryption\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nCreate up to 5 modules and module access policies \\(MAP\\)s using the standard version of Column Level Encryption. MAPs expand on role-based access to allow considerations for:-   System users\n-   Scripts\n-   KMF Resource Exchange\n\nColumn Level Encryption Enterprise supports additional MAPs.\n\n</td><td>\n\nSupport for up to 5 modules and module access policies \\(MAP\\)s\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nEncrypt common field types using the standard version of Column Level Encryption. Column Level Encryption Enterprise supports additional field types.\n\n</td><td>\n\nEncryption for String text, Date and Date/Time fields, attachments, and URLs\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nChoose between standard and equality preserving encryption. When enabled, equality preserving encryption ensures that the encrypted value of a field is the same when the field value remains the same. This type of encryption enables equality comparisons and group by operations on a field.**Note:** Non-deterministic encryption isn’t supported.\n\n</td><td>\n\nEquality preserving encryption support\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nUse `getDisplayValue()` and `setDisplayValue()` APIs to return cleartext values and insert encrypted data for encrypted fields.\n\n</td><td>\n\n`getDisplayValue()` and `setDisplayValue()` APIs\n\n</td><td>\n\nsecurity admin, developer\n\n</td></tr></tbody>\n</table>## Field Encryption Enterprise benefits\n\nColumn Level Encryption Enterprise builds on the existing Column Level Encryption framework and provides these additional features after you purchase a subscription.\n\n<table id=\"table_nhr_54z_ryb\"><thead><tr><th>\n\nBenefit\n\n</th><th>\n\nFeature\n\n</th><th>\n\nRequired Roles\n\n</th></tr></thead><tbody><tr><td>\n\nEncrypt additional field types.\n\n</td><td>\n\nSupport for additional field types:-   HTML\n-   Journal\n-   Translated\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nColumn Level Encryption Enterprise supports more than 5 modules and module access policies to provide more options for access to secured data.\n\n</td><td>\n\nSupport for additional modules and MAPs\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nKeys from a key vault can be rotated on an automated schedule you configure. Using automatic key rotation can improve security while reducing administrative overhead.\n\n</td><td>\n\nConfigurable automatic key rotation\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nManage the full life cycle of your data encryption keys. Optionally, you can securely exchange data encryption keys generated within your environment.\n\n</td><td>\n\nCustomer supplied keys\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nEphemeral keys are cryptographic keys that are generated for each execution of a cryptographic process. These keys more secure because they’re generated for use in a single session.\n\n</td><td>\n\nEphemeral cryptographic keys\n\n</td><td>\n\nsecurity admin\n\n</td></tr><tr><td>\n\nUpdated `setDisplayValue()` and `setDisplayValue()` APIs can insert encrypted data for encrypted fields.\n\n</td><td>\n\nUpdated `getDisplayValue()` and `setDisplayValue()` APIs\n\n</td><td>\n\nsecurity admin, developer\n\n</td></tr></tbody>\n</table>## Cloning considerations\n\nWhen you clone an instance that uses Column Level Encryption, the encrypted field data and encryption modules are copied to the target instance. Because encryption keys are re-encrypted with a secondary key that is unique to the source instance, the target instance can't decrypt the field data after cloning.\n\nUntil a key exchange is performed, encrypted fields on the cloned instance appear empty or unreadable. This is expected behavior and does not indicate data corruption or loss.\n\nTo restore access to encrypted fields on the target instance, complete a key exchange from the source instance. See [Configure Key Exchange](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/platform-encryption/configure-key-exchange.md).\n\n-   **[Column Level Encryption Guided Tour](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/cle-tour.md)**  \nThe tour gives a brief overview of the Column Level Encryption setup needed to encrypt table fields or attachments.​ Steps for the creation of Field Encryption Modules, Module Access Policies, and Encrypted Field Configurations are also covered. The tour includes links to detailed documentation and the ServiceNow University Column Level Encryption Overview course.​\n-   **[Column Level Encryption Enterprise](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/now-platform-encryption-2.md)**  \nColumn Level Encryption Enterprise uses the Key Management Framework \\(KMF\\) to enable you to customize and manage how fields and attachments are encrypted and decrypted on your instance. A subscription is required to use Column Level Encryption Enterprise.\n\n**Parent Topic:**[Column Level Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/column-level-encryption-landing.md)\n\n"}}