Encrypt Manual Task answers

Sensitive customer information is protected by encryption at the Data Store level. However, the same data is used in Manual Tasks, namely, in worker answers from Workspace, thus persisting in system tables without encryption.

A new mechanism was implemented, allowing to protect the sensitive Workspace data at the database level. To use it, enable MS SQL column encryption with Azure Key Vault by performing the steps below.

Create Key Vault and add master key to Key Vault in Azure Portal

For detailed instructions, refer to the official Microsoft tutorial.

After you complete the steps in the tutorial, go to the Access policies page for the created Key Vault. Make sure Key Permissions are set to all of the following:

• create
• get
• list
• sign
• verify
• wrap
• unwrap

Create service principal and configure access policies for Key Vault

For detailed instructions, refer to the official Microsoft tutorial. Working with the instructions, pay attention to the following:

• For service principal authentication, use the instructions described in the Option 2: Create a new application secret section.

• Skip the Assigning a role to the application section.

• Instead, configure access policies as described in the Microsoft tutorial. In the Select principal field, select the created application. Do not select anything for the Authorised application field. For Key permissions, set all of the following:

  • create
  • get
  • list
  • sign
  • verify
  • wrap
  • unwrap

• From Step 4 in the Get tenant and app ID values for signing in section, remember the application (client) ID. From Step 5 in the Option 2: Create a new application secret section, remember the secret value. You need the two strings for configuring database connections.

Encrypt columns

For detailed instructions, refer to the official Microsoft tutorial.

Encrypt the following columns with the Deterministic encryption type:

• For the Workspace (WS) database scheme,param_name and param_value in the hit_submission table.

• For Control Tower (CT) database scheme, forminputname, forminputvalue, correctinputvalue in the awshitassignmentanswer table, jsondataitemvalues in the hitsubmissiondataitem table, and jsonAnswers in the awshitquestion table.

caution

In WF applications, encryption is limited. You can use only the Deterministic type. You cannot encrypt any columns in the database other than the ones listed above.

Configure database connections

To update the database connections for the WS and CT vaults, change the ct.datasource.url and ws.datasource.url properties in WS and CT vaults by appending the following: columnEncryptionSetting=Enabled;keyVaultProviderClientId=ClientID;keyVaultProviderClientKey=SecretKey. Use the Client ID and secret key value generated at the step where you created a service principal.

Example:

#old value
ws.datasource.url=jdbc:sqlserver://YOUR_DATABASE_HOST:1433;databaseName=workfusion;schema=ws
 
#new value
ws.datasource.url=jdbc:sqlserver://YOUR_DATABASE_HOST:1433;databaseName=workfusion;schema=ws;columnEncryptionSetting=Enabled;keyVaultProviderClientId=YOUR_AZURE_CLIENT_ID;keyVaultProviderClientKey=YOUR_AZURE_SECRET_KEY

note

After you are done with the configuration, remember to restart CT and WS.