Siebel Support for Encryption

Question

My customer needs documentation detailing Siebel's support for encryption protocols across all layers
i.e
1) User Interface,
2) Web Session / Transport
3) Database Layer
4) Logs. Cookies
Is there any documentation that someone has prepared from field experience? or does product management maintain any such document?
Any pointer would indeed help! Look fwd. to your inputs.
Regards,
Rakesh

Answer 1

Rakesh,
I would start with the Bookshelf section on Encryption in the Security Guide. Beyond that I am not aware of any single document that addresses all types of encryption. Basic observations follow:
1. User Interface -- Since this is a web application, not sure how this differs from "Web Session". The communications between the end user's browser and the Siebel Web Server can be secured with standard SSL. Higher key lengths require that the Siebel Strong Encryption Pack be installed on both the Siebel Web Server(s) and the Siebel Application Server(s).
2. Web Session / Transport -- The SISNAPI communications between the various Siebel servers can by encrypted using RSA, MSCrypto, or SSL.
3. Database Layer -- This is dependent on the database being used and would be set at the client level for transport. As long as it is transparent to the Siebel application object manager, it should be fine. In terms of actual data storage, Siebel can do field level encryption for specific fields. Alternatively, database encryption utilities such as Oracle's Transparent Data Encryption (TDE) can be used as long as it is transparent to the Siebel application. Encryption of local databases are more restrictive and involve either encrypting the whole local database or not encrypting the local database.
4. Logs and Cookies -- Logs are not encrypted. Cookies can be encrypted in transit when using SSL. Also the session identifier can be encrypted.
Hope this information is at least somewhat helpful.
Stevan