Data Security / Encryption

I'm looking for "encryption at source" with respect to protecting PII from a cyber security insurance perspective. I completely agree with the recommendations already given regarding best practices, but I'm specifically being asked if my PII is encrypted at source by the insurance company. 

Is TDE my best option? Does SugarCRM not directly support some way to do this by flagging specific fields that contain sensitive data that I'm not aware of? 

Thanks in advance for any help on this. 

Hi Brian.

I'd also point out that there is an "encrypt" field type that you can use to store data as encrypted text in the database. But, in general, there's lots of drawbacks to encrypting data at the field/column level. You can search for this data. You can't sort on this data. PII generally covers people's names, addresses, phone numbers... things you'll need to look the customer up. The usability is going to be bad.

https://support.sugarcrm.com/Documentation/Sugar_Versions/11.0/Ent/Administration_Guide/Developer_Tools/Studio/#Field_Types

That's why we typically go with encryption at rest / disk level encryption.

Hi Brian.

I'd also point out that there is an "encrypt" field type that you can use to store data as encrypted text in the database. But, in general, there's lots of drawbacks to encrypting data at the field/column level. You can search for this data. You can't sort on this data. PII generally covers people's names, addresses, phone numbers... things you'll need to look the customer up. The usability is going to be bad.

https://support.sugarcrm.com/Documentation/Sugar_Versions/11.0/Ent/Administration_Guide/Developer_Tools/Studio/#Field_Types

That's why we typically go with encryption at rest / disk level encryption.

Thanks Matt, I agree with everything you said which is why I feel like I'm stuck. 

I don't see a path forward for the an "On Prem" solution that contains PII that is "encrypted at source" without making the platform nearly un-usable for our staff. 

For context, the requirement for "encrypting PII at source" is coming from our Cyber Insurance and I feel like there is real breakdown between the lawyers and a use-able solution.