"Encryption at rest for all data" does not really mean all data

"Encryption at rest for all data" does not really mean all data

avatar

I was excited to read in the changelog that version 2019.2.12.0 (December 16th 2019) of DPS had in its changelog "Encryption at rest for all data (requires regenerating encryption keys in DPS Console and makes data unreadable using direct SQL queries)". Per the instructions, I regenerated my encryption keys with no errors and opened up SQL to ensure data was "unreadable using direct SQL queries". I was surprised to see that certain data was still very much readable, including fields like certificate names, connection names, user names, etc. I opened a ticket (DEVO-28055) to get clarification and they replied back:

"Only certain fields are encrypted in the database, for example, passwords and users (private) vaults"

I feel it is important to those of us who read "all data" to mean "all data" that we understand that only certain fields are encrypted. I have requested Devolutions update their documentation as I believe their statement is misleading.

All Comments (2)

avatar

Hello Paul,

Our engineering team is currently looking at your inquiry and we will provide an update as soon as possible.

Best regards,

Richard Boisvert

avatar

Thanks, Richard. I am hoping that this is just an issue with the re-encryption process and that all data at rest should be encrypted.