Platform Encryption - Things to know before activating Platform Shield

In my other post Platform Encryption - Encryption at Rest, I have talked about how platform encryption works. This is post is related to what are the things to know before activating Shield and what can be proposed solutions.

Use Case

XYZ Company is already using a Production organization for couple of years and now Business wants to encrypt following fields which might contain PII, PHI information like:

Account:

• Name
• Shipping Address (Street, City)
• Other custom fields

Contact

• Name
• Phone
• Mailing Address (Street, City)
• Other custom fields

Case Comment

• Body

Attachment

• Body

Task

• Description

And there could be other Custom objects and fields can be encrypted.

Analyze the impact

We can get Platform Shield license in Developer Edition to play around, but actual impact analysis can only be done on Developer or Partial Copy  or Full Copy Sandbox.

Prepare a sandbox

Contact Salesforce for activating Shield in Production, and then refresh the sandbox or without refreshing - from Company Information, click on Match Production Licenses button and wait for a mail to apply production licenses on sandbox.

Prerequisite for encryption

First, Generate Tenant Key in the org.

Go to Setup ➜ Platform Encryption ➜ Key Management

What are the fields can be encrypted?

Refer Salesforce Shield Platform Encryption Implementation Guide for more details.

To encrypt Standard fields, navigate Setup ➜ Platform Encryption ➜ Encryption Policy

And click on Encrypt Fields link to encrypt desired standard fields.

For custom fields, edit the field details.

How newly created records can be encrypted?

If we create a new field and create a record then value will be encrypted with the keys.

How existing records can be encrypted?

If we update an existing record, even if without changing any values from UI and pressing Save button, the values will be encrypted.

By loading .csv file through data loader, existing records can be encrypted.

But, for those updates we will see Last Modified By and Last Modified Date changes.

For mass update (including attachments), contact Salesforce support, who can run the job during off-hours. Beauty of this update is Last Modified By or date are not getting changed.
Secondly, no need to deactivate any triggers, workflows etc to perform this job which runs by Salesforce.

How do I know how many records are encrypted and how many are pending to be encrypted?

Encryption Statistics will give the full details.

Setup ➜ Security Controls ➜ Platform Encryption ➜ Encryption Statistics

What will happen if we try to mark the field as encrypted?

Salesforce verifies following areas if it has been used:

• Portals
• Criteria-Based Sharing Rules
• SOQL/SOSL Queries
• Formula Fields
• Skinny Tables
• Microsoft Integration Products

Salesforce sends an email that field cannot be encrypted because of the reasons. Here is an example.

Note: 

a. If field has been used in the report filter then marking field as encrypted will automatically remove the filters from the report. Salesforce will not show any error messages.

b. If field has been used in the list view filter then marking field as encrypted will automatically remove the filters from the list view. Salesforce will not show any error messages.

What will happen if we have existing Case comments?

If comment body contains more than 2959 characters then that record cannot be encrypted.

Also, after marking the Case Comments body field as encrypted, if we try to enter more than 2959 character, Salesforce will not allow to save.

Can encrypted fields be used in filters?

Encrypted fields are NOT available in List View filters, Report filters. Though those fields can be used a column to display those values.

Can encrypted fields be used for sorting?

Encrypted fields are NOT sort-able in List view.

Can encrypted field values be searchable by Global search?

Yes, encrypted field values are searchable through global search.

What will we see if reports are exported with encrypted data?

The extracted .csv file will shows the data in a normal way (seems like it is not encrypted).

If we run a SOQL query from Developer Console or in apex code how the encrypted data gets displayed?

The encrypted field data will return normally seems like it is not encrypted.

What could be impacts on integration, lets say from Salesforce a JSON string is passed to third party application or a third party application updating Salesforce?

There is no need for data transformation. Request will show same type of data as if it looks like un-encrypted.

[{
  "ContactID" : "0030j00000BfcpGAAR",
  "Phone" : "9087654567",
  "MiddleName" : null,
  "LastName" : "Boral",
  "FirstName" : "Santanu",
  "Fax" : null,
  "Email" : "san.boral@xyz.com"  
}]

What could be impacts on data migration if we import the data into Salesforce?

There should not be any changes to be made in the .csv and there should not be any delay due to encrypting data (minor unnoticeable lag but it's okay). 

What could be the impacts if existing managed package is already having SOQL WHERE clause with LIKE operator on Account Name which we are trying to encrypt?

Until and unless that managed package code is rectified, Account Name cannot be encrypted.

Also, it is recommended to managed packaged developer that they handle this kind of scenario, so that target organisation can perform encryption in future.

How Task's description can be encrypted?

This part is interesting. Till today (Spring 18 release), Salesforce doesn't allow Task records to be encrypted. So, if we have existing task description records then, we need to create custom object and create a custom description field (refer picture of Comment field) and store the records during creation and updating of Task.

Any changes on Platform Encryption at Spring 18 release?

Salesforce comes with filtering Encrypted Data with Deterministic Encryption (Beta) .

Deterministic encryption supports WHERE clauses in SOQL queries and is compatible with unique and external ID fields and custom indexes. 

For example, you might run a SOQL query in custom Apex code against the Contact object, where LastName = 'Smith'. If the LastName field is encrypted with probabilistic encryption, you can’t run the query. Deterministic encryption addresses this problem.

For more information, refer Filter Encrypted Data with Deterministic Encryption (Beta)

Further Reading

Platform Encryption - Encryption at Rest

References

Salesforce Shield Platform Encryption Implementation Guide

Platform Encryption - Encryption at Rest

Use Case

Recently, I got a requirement to implement Salesforce Shield (platform encryption) at our salesforce organization. It brings a question to me how Salesforce uses platform encryption and encrypt the data at Rest.

Solution

If we refer Salesforce Shield Platform Encryption Implementation Guide, we get to know how below process flow works and I am not going deep into this as going through the pdf we can understand the flow and ultimately data is derived based on master key and tenant key.

For a sake of proof of concept, I have defined Case Subject, Description and Case comment fields to be encrypted.

To do this follow: Setup -> Platform Encryption

Click on Encrypt Fields link to reach Encrypt Standard Field page and defined as follows:

Then, I have created a sample case with this subject and description:

If I try to query the same case record from the Developer Console, it returns as follows:

Now, how can I prove that data is encrypted as I can see the data as usual. Moreover there is no such proof of Encypted indicator as I can see for attachment as follows:

This makes me curious about this poc.

Approach

First I described the Case Subject field from workbench and it displays as encrypted and also thought that I am an authorized user to access this record that's why I can read the data in a normal way. But I was not satisfied with this.

To make it full proof, I archived the tenant key and exported the key as backup.

Then, destroyed the tenant key based on which that case subject and description got generated.

Now, accessed the same record, it is showing ????? (means, This service is unavailable now). This means encrypted data which has been encrypted with my previous tenant key is not available.

That sounds interesting to me.

But, how can I retrieve the previous data then?

So, I imported the same previous tenant key as follows:

After importing, accessed the same case record. It showed the data again.

Conclusion

It gives me confidence that subject and description standard fields have been encrypted properly with Salesforce shield and encrypted at Rest.

Further Reading

Platform Encryption - Things to know before activating Platform Shield