Encryption
Configuration encryption
Starting from WorkFusion 8.4 release, the sensitive configuration properties have been moved to the encrypted secured Password Vault. Out of the box, WorkFusion platform is bundled with HashiCorp Vault by default. Alternatively, the CyberArk AIM instance (licensed separately from WorkFusion platform) can be used.
Refer to the topics below for more details:
- WorkFusion IA 2017 Sunbird Password Vault
- Manage Secure Properties
Data encryption at rest
WorkFusion platform supports operating on the encrypted hard disks.
Disk encryption software or hardware encrypts every bit of data written to a disk or a volume.
For Linux/RHEL 7 servers the common solution for encryption is to use Dm-crypt/LUKS subsystem.
Often, requirement for disk encryption is enforced by the infrastructure or cloud provider and enabled by default on all provided servers or virtual machines. For example, Google Cloud Platform encrypts the data stored "at rest" by default.
tip
Use the links below to get additional information about data encryption:
Data encryption in transit
The WorkFusion platform supports transferring data over secured channels.
A demand for data encryption in transit can occur, when dealing with a federated network topology, for example, when different components of software are installed in different data centers, networks or sub-networks.
For this cross network transfer a typical common solution is the network level encryption such as IPSec or SSH tunneling.
While transferring data between two servers or virtual machines residing in a single trusted sub-network, enabling the the in-transit encryption is not an option due to performance considerations.