Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Nikhil Agarwal (Nikhil_Agarwal)

CA
Nikhil_Agarwal Member since 2015 37 posts
Posted: Feb 13, 2017
Last activity: Mar 7, 2017
Posted: 13 Feb 2017 13:29 EST
Last activity: 7 Mar 2017 12:18 EST
Closed
Solved

How is Cassandra data protected.?

Hi Folks

Our security team raised a question regarding security for cassandra data. We are using DSM/ESM for analytics and storing customer's insights in Cassandra through a data set. They want to know that what's the security of this storage.? Is there any encryption present.?

Thanks

To see attachments, please log in.
Data Integration
Decision Management
Security

Accepted Solution

Posted: 7 years ago
Posted: 15 Feb 2017 21:13 EST
Ashutosh Arya (Aryaa)
PEGA
Senior Manager, Technical Support - Runtime Engine and Search
Pegasystems Inc.
AU

Which version of Pega you are using? In Pega 7.2.1 Cassandra can be separate from DSM.

Cassandra.yaml file can be updated to enable encryption. Have you tried it?

Sample shown below:

Show More

Which version of Pega you are using? In Pega 7.2.1 Cassandra can be separate from DSM.

Cassandra.yaml file can be updated to enable encryption. Have you tried it?

Sample shown below:

  1. # necessary for node-to-node communication encryption
  2. server_encryption_options:  
  3.     internode_encryption: none  
  4.     # Keystore can be repointed to generic implementation once it is in place.  
  5.     # This is important for Cloud implementation  
  6.     keystore: conf/.keystore  
  7.     keystore_password: cassandra  
  8.     truststore: conf/.truststore  
  9.     truststore_password: cassandra  
  10.     # More advanced defaults below  
  11.     # protocol: TLS  
  12.     # algorithm: SunX509  
  13.     # store_type: JKS  
  14.     # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE        _RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]  
  15.     # require_client_auth: false  
  16.     # require_endpoint_verification: false  
  17. ...  
  18. # enable or disable client/server encryption.  
  19. client_encryption_options:  
  20.     enabled: false  
  21.     # If enabled and optional is set to true encrypted and unencrypted connections are handled  
  22.     optional: false  
  23.     # Keystore can be repointed to generic implementation once it is in place.  
  24.     # This is important for Cloud implementations  
  25.     keystore: conf/.keystore  
  26.     keystore_password: cassandra  
  27.     # require_client_auth: false  
  28.     # Set trustore and truststore_password if require_client_auth is true  
  29.     # truststore: conf/.truststore  
  30.     # truststore_password: cassandra  
  31.     # More advanced defaults below:  
  32.     # protocol: TLS  
  33.     # algorithm: SunX509  
  34.     # store_type: JKS  
  35.     # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]  
  36. ...  
  37. # Enables encrypting data at-rest (on disk).  
  38. # This is not needed if we run Cassandra on AWS and use EBS storage  
  39. transparent_data_encryption_options:  
  40.     enabled: false  
  41.     chunk_length_kb: 64  
  42.     cipher: AES/CBC/PKCS5Padding  
  43.     key_alias: testing:1  
  44.     # CBC IV length for AES needs to be 16 bytes (which is also the default size)  
  45.     # iv_length: 16  
  46.     key_provider:  
  47.       - class_name: org.apache.cassandra.security.JKSKeyProvider  
  48.         parameters:  
  49.           # Keystore can be repointed to generic implementation once it is in place.  
  50.           # This is important for Cloud implementations  
  51.           - keystore: conf/.keystore  
  52.             keystore_password: cassandra  
  53.             store_type: JCEKS  
  54.             key_password: cassandra

Show Less
To see attachments, please log in.

Accepted Solution

Posted: 7 years ago
Posted: 15 Feb 2017 21:13 EST
Ashutosh Arya (Aryaa)
PEGA
Senior Manager, Technical Support - Runtime Engine and Search
Pegasystems Inc.
AU

Which version of Pega you are using? In Pega 7.2.1 Cassandra can be separate from DSM.

Cassandra.yaml file can be updated to enable encryption. Have you tried it?

Sample shown below:

Show More

Which version of Pega you are using? In Pega 7.2.1 Cassandra can be separate from DSM.

Cassandra.yaml file can be updated to enable encryption. Have you tried it?

Sample shown below:

  1. # necessary for node-to-node communication encryption
  2. server_encryption_options:  
  3.     internode_encryption: none  
  4.     # Keystore can be repointed to generic implementation once it is in place.  
  5.     # This is important for Cloud implementation  
  6.     keystore: conf/.keystore  
  7.     keystore_password: cassandra  
  8.     truststore: conf/.truststore  
  9.     truststore_password: cassandra  
  10.     # More advanced defaults below  
  11.     # protocol: TLS  
  12.     # algorithm: SunX509  
  13.     # store_type: JKS  
  14.     # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE        _RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]  
  15.     # require_client_auth: false  
  16.     # require_endpoint_verification: false  
  17. ...  
  18. # enable or disable client/server encryption.  
  19. client_encryption_options:  
  20.     enabled: false  
  21.     # If enabled and optional is set to true encrypted and unencrypted connections are handled  
  22.     optional: false  
  23.     # Keystore can be repointed to generic implementation once it is in place.  
  24.     # This is important for Cloud implementations  
  25.     keystore: conf/.keystore  
  26.     keystore_password: cassandra  
  27.     # require_client_auth: false  
  28.     # Set trustore and truststore_password if require_client_auth is true  
  29.     # truststore: conf/.truststore  
  30.     # truststore_password: cassandra  
  31.     # More advanced defaults below:  
  32.     # protocol: TLS  
  33.     # algorithm: SunX509  
  34.     # store_type: JKS  
  35.     # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]  
  36. ...  
  37. # Enables encrypting data at-rest (on disk).  
  38. # This is not needed if we run Cassandra on AWS and use EBS storage  
  39. transparent_data_encryption_options:  
  40.     enabled: false  
  41.     chunk_length_kb: 64  
  42.     cipher: AES/CBC/PKCS5Padding  
  43.     key_alias: testing:1  
  44.     # CBC IV length for AES needs to be 16 bytes (which is also the default size)  
  45.     # iv_length: 16  
  46.     key_provider:  
  47.       - class_name: org.apache.cassandra.security.JKSKeyProvider  
  48.         parameters:  
  49.           # Keystore can be repointed to generic implementation once it is in place.  
  50.           # This is important for Cloud implementations  
  51.           - keystore: conf/.keystore  
  52.             keystore_password: cassandra  
  53.             store_type: JCEKS  
  54.             key_password: cassandra

Show Less
To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice