Question
Coforge Technologies (Erstwhile Incessant Technologies)
GB
Last activity: 26 Apr 2017 6:18 EDT
How secure the BLOB content is? Is BLOB really needs encryption with a Cipher
As BLOB column in internal tables is encoded by PEGA, I would like to know whether it is readable by any database extractor tools. The compression algorithm used by PEGA is secured and confidential, how could we assure the clients the BLOB is always safe and secure. We have BLOB encryption with a customized site specific cipher algorithm which can be configured at class rule level that cannot be reverted back is the best approach but have performance limitations. Please share if any one knows what kind of standard algorithm PEGA uses for BLOB encoding that cannot be broken, or if the BLOB encoding is not secure and it is always suggestable to choose BLOB encryption for secure and sensitive data.
Cognizant Technology Solution
US
BLOB content is encrypted but Ciphar algorithm may be applied explicitly. The below link might help you understanding more.
https://docs-previous.pega.com/encrypting-properties-and-blobs
Coforge Technologies (Erstwhile Incessant Technologies)
GB
Hi Arnab,
My question is how BLOB is secure without cipher encryption, as we know BLOB is already in encoded format which is not readable, whether is it secure enough or we should go for cipher encryption for more confidentiality.
Regards,
Praveen.
Pegasystems Inc.
IN
With out cipher encryption BLOB is not secured. Data in BLOB column in not secured by default , and it is just compressed/obfuscated. If we don't secure using cipher encryption we can easily de-compress the data in BLOB using the stream reader.
Thank You,
Surendra.PV
Coforge Technologies (Erstwhile Incessant Technologies)
GB
Hi Surendra,
Thanks for your reply. PEGA suggests BLOB encryption will work at initial stage of the project, once it has unencrypted BLOB records, means middle of the project we cannot convert or check the "Encrypt BLOB" in class definition rule. If client decides to have encrypted BLOB in middle of the project, how to fulfill or implement the requirement, Is Pega provides some alternative for that.
Regards,
Praveen.
Pegasystems Inc.
IN
As per my knowledge, the site-specific cipher for a PRPC implementation must be created and implemented before any data is entered into properties or BLOBs which must be encrypted. There is currently no facility for encrypting existing data.
Thank You,
Surendra.PV
Tata Consultancy Services
US
Refer this link , this has all the necessary resources that pega offers. also you can explore other db level encryption methods to encrypt blobs.
https://pdn.pega.com/security/how-to-encrypt-passwords-properties-and-blobs