Question
Common Wealth Bank of Australia
AU
Last activity: 23 Feb 2022 3:56 EST
BIX extract output file encryption / password protection
Hi,
We have a requirement to encrypt the BIX extract output (i.e. csv/xml) due to the sensitivity of the data being extracted. I could find articles related to encrypting the DB passwords/BIX operator using keyring file but not much details available on encrypting (password protecting) the BIX csv/xml file. Any help will be appreciated. Thanks
Pegasystems Inc.
NL
Hi @karthigeyanr, BIX doesn't have a feature to encrypt the csv/xml output file.
You can look at field level encryption using TextEncrypted properties or architect an alternative solution such as:
- outputting directly to a secure database, eliminating the need to encrypt files
- perform some lower level filesystem encryption, if your on-prem infrastructure supports this
- manually encrypt the unencrypted BIX export file with help of file listener, activity and cleanup of unencrypted file.
However if your client is security minded, I strongly recommend spending time on upgrading to Pega 8 first.
Common Wealth Bank of Australia
AU
Thanks @Eric Rietveld for your response
We are exploring options to encrypt the csv/xml files on the filesystem once the BIX execution is complete. As there are very strict SLA for the file to be secured (converting the plain text file to encrypted) we are checking if BIX can encrypt at the end of the execution
As mentioned above if we can use an activity (via file listener) to encrypt the BIX output file, I am just thinking if we can trigger the BIX execution via an Agent (instead of command line BIX client) & encrypt the file data (in clipboard) before it writes on the disk. Please let me know your thoughts & if it is feasible.
Pegasystems Inc.
NL
Hi @karthigeyanr, you can run the Extract from an Agent (Job Scheduler) to call pxExtractDataWithArgs and immediately pick-up the file for post processing or through file listeners. I don't think you can intercept the BIX file write-out and encrypt in memory. Note that you should actually trust your filesystem. Remember that your filesystem contains all configuration files needed to reach the underlying database.