Encrypt sensitive data

Sensitive customer information is protected by encryption at the Data Store level. However, the same data is used in Manual Tasks, namely, in worker answers from Workspace, thus persisting in system tables without encryption.

The data protection in Data Store column tables is performed with the help of the Always Encrypted feature. Control Tower Workers have required dependencies for Always Encrypted based on Azure.

caution

See the limitations for using Always Encrypted in the official documentation.

Create Key Vault and add master key to Key Vault in Azure Portal

A new mechanism was implemented, allowing to protect the sensitive Workspace data at the database level. To use it, enable MS SQL column encryption with Azure Key Vault by performing the steps below.

For detailed instructions, refer to the official Microsoft tutorial.

After you complete the steps in the tutorial, go to the Access policies page for the created Key Vault. Make sure Key Permissions are set to all of the following:

• create
• get
• list
• sign
• verify
• wrap
• unwrap

Create service principal and configure access policies for Key Vault

For detailed instructions, refer to the official Microsoft tutorial. Working with the instructions, pay attention to the following:

• For service principal authentication, use the instructions described in the Option 2: Create a new application secret section.

• Skip the Assigning a role to the application section.

• Instead, configure access policies as described in the Microsoft tutorial. In the Select principal field, select the created application. Do not select anything for the Authorised application field. For Key permissions, set all of the following:

  • create
  • get
  • list
  • sign
  • verify
  • wrap
  • unwrap

• From Step 4 in the Get tenant and app ID values for signing in section, remember the application (client) ID. From Step 5 in the Option 2: Create a new application secret section, remember the secret value. You need the two strings for configuring database connections.

tip

For details on encrypting Manual Task answers, see the instruction.