2

In my dev org I have enabled platform shield, created tenant secrete key and enabled encryption for attachments and files. I can see fields are getting encrypted properly but uploaded attachments are not. Is there anything more that needs to be done in order to encrypt attachments. Testing way:

Took one xml attached to one of the record where one of the field is already marked for encryption(Though this is not required.) Now downloaded the attached attachment and I am able to see the completed data. I was assuming the data should have been encrypted but it is not. Is there something which I am missing? Any pointers would be very helpful.

For files I am seeing different behavior as compared to fields on sobjects. enter image description here

4

The behaviour is documented here

Files remain visible to users who have access to them even when they are encrypted. If data in a file must remain hidden, use the appropriate sharing settings.

There is a different between masking and Encryption .Platform Shield encryption for Files does encryption known as Encrypted data at Rest and file is encrypted at Data layer before uploaded but not masked .

Platform encryption is primarily to meet security compliance policies of healthcare,financial and many other industries where data in harddisk is protected using Tenant key .So lets say the entire hard disk (From Salesforce Data Center )is stolen then the attacker still needs a Tenant key to steal the data

  • If that is the case then what kind of encryption is provided on files. Because if user can download and view its content, then whats the purpose of encryption. Am I missing anything here? – Kiran Machhewar Sep 10 '16 at 17:05
  • Yes you are missing lot of things .So platform encryption is primarily to meet compliance policies of healthcare and many other industries where data in harddisk is protected using Tenant key .So lets say the entire hard disk (From Salesforce Data Center )is stolen then the attacker still needs a Tenant key to steal the data .Hope it makes sense now . – Mohith Shrivastava Sep 10 '16 at 17:13
  • And Tenant key is still on the cloud securely generated from other device and hardware . – Mohith Shrivastava Sep 10 '16 at 17:15
  • Agreed, I was hoping same kind of masking on files too as salesforce does it for fields on sobjects. So this file level encryption is something that we can never verify :P – Kiran Machhewar Sep 10 '16 at 17:17
  • Yes except you can programmatically check if the field isEncrypted is true in the query .The query you wrote just pull isEncrypted field will show true and then you can build custom solutions if you need to mask . – Mohith Shrivastava Sep 10 '16 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.