Database Security

Matrix42 installation

Reinforced sensitive data encryption is provided by default starting from the version 9.1.2.

Matrix42 system update

The database encryption mechanism is not upgraded by the regular Matrix42 system update. The ReEncryptData tool for reinforced sensitive data encryption should be run manually.

Prerequisites

To complete this walkthrough, you will need the following:

• Matrix42 Software Asset & Service Management 9.1.1 or lower;
• Microsoft PowerShell 4.0 or greater installed and configured on the server that hosts Matrix42 Software Asset & Service Management;
• User with administrator rights.

Encryption key 

The current database encryption key is stored in the key attribute of the configuration file:

%ApplicationFolder%/bin/securityCryptographyConfiguration.config

<?xml version="1.0" encoding="utf-8"?>
<securityCryptographyConfiguration>
  <databaseEncryption key="current_key" />
</securityCryptographyConfiguration>

Running data re-encryption script

Data re-encryption script is run manually as a PowerShell command by the user with Administrator rights:  

%ApplicationFolder%/Config/PowerShellScripts/ReEncryptData.ps1

The script requires database access credentials:

Successfully run data re-encryption script:

First run

The first run of the data re-encryption script generates the new database encryption key and stores the previously used one:

%ApplicationFolder%/bin/securityCryptographyConfiguration.json

<?xml version="1.0" encoding="utf-8"?>
<securityCryptographyConfiguration>
  <databaseEncryption key="NewKey" key0="PreviousKey" />
</securityCryptographyConfiguration>

All values listed in the data re-encryption script are encrypted with the new key and get a "1 " prefix assigned to the encrypted value:

Data from the fields that were encrypted with the previously used key and were not added to the list of the re-encrypted fields are still operational, as the previous encryption key is kept by default.

The candidate-fields missed during the first run of the script can be included in the PowerShell script manually, and re-encrypted with the new key during the subsequent run of the %ApplicationFolder%/Config/PowerShellScripts/ReEncryptData.ps1 

Extending encryption data set

ReEncryptData tool re-encrypts the default system data.  This change is applied to the standard attributes of the provided by default Data Definitions and re-encrypts mainly passwords for accessing third-party systems like e-mail server or Active Directory account credentials. The complete list of the re-encrypted data is available in the ReEncryptData tool.

Any custom fields that store encrypted data (passwords, user credentials, or any other sensitive data) that should be re-encrypted must be added to the list of default system data. The changes can be added to the ReEncryptData tool as follows:

%ApplicationFolder%/Config/PowerShellScripts/ReEncryptData.ps1

 @{
     Name = "DataDefinitionName"
     Columns = @("CustomColumnName")              # syntax for the single column update
  },
 @{
     Name = "CustomDataDefinitionName"
     Columns = @("Column1", "Column2", "Column3") # data re-encryption example for multiple attributes of the same Data Definition  
  },

Subsequent runs

All subsequent runs can be performed manually and are required if the custom fields were manually added to the standard list of encrypted fields.

Data re-encryption script particularities during the subsequent runs:

• the new encryption key is not generated. The data encryption uses the current key value from the %ApplicationFolder%/bin/securityCryptographyConfiguration.json;

• re-encrypting all necessary values without the  ''1 " prefix with the current encryption key, assigning "1 " prefix accordingly;

• automatically restarting Martix42 services.