Click Studios uses Symmetric Data Encryption within Passwordstate to protect your sensitive data. It does this using 256bit AES (Advanced Encryption Standard) data encryption to encrypt (cipher) and decrypt (decipher) information. At a high level the process of encryption and decryption looks like this;
AES is the first and only publicly accessible cipher approved by the US National Security Agency (NSA) for protecting top secret information. 256bit AES is practically unbreakable by brute force based on current computing power, making it the strongest encryption standard available. In short, by using symmetric encryption algorithms, data is converted into a form that cannot be understood by anyone not possessing the secret key to decrypt it.
NIST the National Institute of Standards and Technology, recommends that Symmetric Data Encryption Keys be changed every 2 years, or earlier based on an organization’s risk factors. Your Passwordstate Encryption Keys shouldn’t be “set and forget”, they should be managed and rotated on a regular basis.
But Before You Start…
Make sure you have a backup of your Passwordstate Database and take a copy of your Web.config file. The built-in Backup functionality is perfect for taking a backup and you can do this by navigating to Administration->Backups and Upgrades->Backup Now.
If you’ve never used the built-in functionality, you’ll need to configure settings first under Administration->Backups and Upgrades->Settings. Information on how to do this can be found here https://www.clickstudios.com.au/documentation/ for both Domain and Workgroup implementations.
Follow the Bouncing Ball…
Now that you’ve taken a backup of your Passwordstate database and have a copy of your Web.config file you’re ready to get started. And it really is as easy as following the bouncing ball!
Under Administration->Encryption Keys you’ll find 2 buttons, Export Keys and Key Rotation. Export Keys allows you to create a password protected Zip file containing your Encryption keys and we’ll cover more on that later. First, we’re going to focus on Key Rotation. To get started click on the Key Rotation button,
You’ll now be prompted to ensure you have a backup of your Passwordstate Database and a copy of your Web.config file. Take the time to read through the information before clicking on the box next to I have read the notification above and understand some action is required of me before and after the key rotation. If this check box isn’t ticked then you won’t be able to proceed with the Key Rotation. Once you’re ready, and you’ve ticked the check box, you can click on the Begin Key Rotation button,
As you can see in the image above, The Encryption Key Rotation screen lists all of the tables, the number of records in each table and the Status for each. To commence the rec-encryption process click on the Re-Encrypt Data button.
The status symbol of a Clock means that table hasn’t been re-encrypted yet. The status of a Tick means the table has now been re-encrypted and the Flashing Blue Squares identifies the current table being re-encrypted. A Status message of Please Wait… is shown at the bottom left-hand-side of the display grid listing the tables.
As the tables are re-encrypted, they will cycle off the first page of the display grid and be replaced by tables awaiting to be re-encrypted. When there are less tables awaiting to be re-encrypted, than take up the full display grid, you’ll start to see those tables that have been completed (shown by a status of Tick) moving back up the display grid. Once complete you’ll be taken to the Key Rotation Complete Screen. Again, take the time to read through the information before clicking the Start Passwordstate button. This will log you off and you will need to log back into Passwordstate.
Don’t Forget… Take a copy of your New Encryption Keys
Now, cycling back to the Export Keys button. Once you’ve successfully rotated your encryption keys it’s good practice to take a copy of them. This can be done by navigating to Administration->Encryption Keys and clicking on the Export Keys button. You’ll be taken to the Export Encryption Keys screen which tells you that the split secrets that make up your Passwordstate Encryption Keys are exported via a Password Protected ZIP file. To begin the export process, click on the Export Keys button,
This will pop up the Password Protected Zip File dialog, which will require you to supply a password for the Zip file. You will also be required to check the box stating that you cannot use the native Windows Compression to extract the contents of the Zip file. Once that’s done you can click on the Export Keys button to create the Zip file containing the exported encryption keys.
The process of rotating your Passwordstate Encryption Keys is that simple and the effort required to rotate them is minimal. There really is no reason not to be managing them appropriately.
We’d love to hear your feedback, send it to support@clickstudios.com.au.