Data Encryption at Rest/Transit

Hi,

I don’t believe we have documented this externally as of now beyond the reference at https://docs.cognite.com/cdf/trust/security/#cognite-keeps-your-data-private .

We primarily utilize the capabilities from the cloud vendors when it comes to encryption at rest. We may have taken some additional steps in key places, where we have identified additional needs, but in general it is based on the cloud vendor for the CDF cluster a project resides on. We do not currently expose any control over this through our APIs.

When it comes to data encryption in transit, we currently only expose TLS. We restrict the versions to avoid very old versions and have also removed some weak or vulnerable ciphers from our accepted list, although we do have to take into account traffic from some industrial clients that our customers find hard to keep up to date with the latest standards. We also ensure transit security within clusters by using transit-encryption, and here we have more room to use stricter configurations than what is exposed externally.

We currently do not support mTLS externally, and it is currently not on our roadmap to do so. It is a interesting alternative to further secure client traffic, but does require a bit more administration work.

Thorkild, Cognite

@Thorkild Stray  Thank you for your detailed response. This is exactly the information we needed to explain to our clients how Cognite ensures data security both at rest and in transit. Your approach makes total sense and provides a comprehensive understanding of the measures in place to guarantee security.