Skip to main content
A
Ashritha15-Moonstone
15-Moonstone
March 16, 2022
Solved

PostgreSQL Database Encryption for data protection

  • March 16, 2022
  • 2 replies
  • 3130 views

Hi team,

 

Need some help in dealing following scenario in ThingWorx.

 

We have some sensitive data that needs to be stored in ThingWorx postgres database.

Currently data can be directly visible from database , if we know connection string , username and password.

But we want to make sure even if the person have connection details, data should not be in the human readable form.

Does ThingWorx support this type of Database encryption technique?

If yes please share the related links to do the same.

 

 

Thank you!!

Best answer by geva

Hi - Check out the encrypted PASSWORD base type.  This provides for encrypting specific sensitive data which will be encrypted at the application layer instead of the database layer.  If you need whole database or table specific encryption then this is something that you should work with your I.T. provider on. We do support having encrypted databases as long as those still meet the specification of our supported databases, versions, and operating systems.

 

Also I will caution you that expecting to encrypt everything will add an extremely large amount of overhead for resources required to manage this, to build, test, maintain the code, as well as troubleshooting the issues.  Best practice is to apply security - including but not limited to - encryption across many layers and components of an overall solution as this will provide better comprehensive coverage.  For example data coming from PLCs is most likely not encrypted, you should question if it is more important to provide things like critical alarms to plant operations teams, or if that should be encrypted and only available to authorized personnelle.  If it is the latter, then the plant systems need also to be encrypted.

2 replies

Z
zyuan15-Regular Member
5-Regular Member
March 16, 2022

TWX supports data encryption, you may check the password for TWX users, they are not readable.  There are also encryption APIs in the snippet.

A
Ashritha15-MoonstoneAuthor
15-Moonstone
March 16, 2022

Hi @zyuan1 ,

Yes, password is encrypted. But we want to encrypt entire database. 

I mean database should not have human readable data. Only ThingWorx should be able to decrypt data and give output in human readable form.

Is this possible?

Z
zyuan15-Regular Member
5-Regular Member
March 18, 2022
We used SQL cmds to store data in DB a lot, but hardly need to encrypt and decrypt data in every transaction. So if you want to make the whole DB unreadable,

1. Control the DB user name & password, make it not accessible to most people

2. Find some method in DB itself, letting data getting encrypted (didn't know if there's such function)
G
geva15-MoonstoneAnswer
15-Moonstone
September 14, 2022

Hi - Check out the encrypted PASSWORD base type.  This provides for encrypting specific sensitive data which will be encrypted at the application layer instead of the database layer.  If you need whole database or table specific encryption then this is something that you should work with your I.T. provider on. We do support having encrypted databases as long as those still meet the specification of our supported databases, versions, and operating systems.

 

Also I will caution you that expecting to encrypt everything will add an extremely large amount of overhead for resources required to manage this, to build, test, maintain the code, as well as troubleshooting the issues.  Best practice is to apply security - including but not limited to - encryption across many layers and components of an overall solution as this will provide better comprehensive coverage.  For example data coming from PLCs is most likely not encrypted, you should question if it is more important to provide things like critical alarms to plant operations teams, or if that should be encrypted and only available to authorized personnelle.  If it is the latter, then the plant systems need also to be encrypted.

Terms & ConditionsCookie settingsAccessibility statement