Encryption at rest proof

[whoknows]

Hello,

Facebook requires that we prove our data is encrypted at rest based on the following:

https://developers.facebook.com/docs/development/maintaining-data-access/data-protection-assessment/...

We have our app in google cloud and I know that encryption at rest is by default in google cloud but I have no idea on how I can prove that to facebook based on the provided link.

Any help or ideas on this will help us from having Facebook shut down our business as their requirement comes with nifty price on our end.

Thanks in advance.

-Jim

[GlebO]

Hi,

Sorry, cannot read the link - the page is not accessible for me. 

Maybe the reference from Google documentation about encryption can help. Here is the link to the Cloud SQL encryption description https://cloud.google.com/sql/docs/mysql/faq#encryption . 

And here is the compliance central page if they need more information https://cloud.google.com/security/compliance 

Will it be enough to prove it?

[lmw]

@GlebO we're encountering the same issue. We linked to the documentation and they're still saying it's not enough proof. 🙄 Is there anywhere in the UI where there's a little green icon next to the word encryption or something?

[GlebO]

Hi,

What kind of proof would satisfy them? I don't think we have a green checkmark for encryption at rest for databases. If you choose to use CMEK (Customer Managed Encryption Key)  then it will be clearly stated in the configuration. But by default it uses the Google managed encryption key. You can show it on the screen for database creation. 

[lmw]

I'll give that a try. I don't think the reviewer is thinking too critically in this case, so any view of a config about encryption will probably suffice... Thank you @GlebO!

[whoknows]

We did post pretty much anything and everything we could, we also checked with google support, they rejected again and again, out last post which is pending approval included switching to CMEK and provide some output of:

gcloud sql instances describe <instancename>
gsutil ls -L -b <bucket>

By enrolling to CMEK we get some additional information on the encryption status that are missing from google managed encryption. We also included all kind of google docs on encryption policy, dashboard screenshots, documentation on how encryption at rest is implemented on our end. 

The status of our last post is still unknown. I hope the information gets approved as there is absolutelly no idea by anyone around my field on what else could fit their requirements.