Encryption for data in transit

[Marcel]

Looking at the available documentation:

https://docs.saviyntcloud.com/bundle/EIC-Architecture/page/Content/Saviynt-Architecture.htm#Visibili
https://forums.saviynt.com/t5/identity-governance/encryption-used-in-saviynt-cloud-for-the-data-pres...

Saviynt supports data encryption in transit via SSL (and VPC / VPN). Strong encryption schemes such as AES (256 / 128 bit) and 3DES are supported. Data at rest is encrypted via native DB encryption. Currently, only predefined data fields are encrypted at rest.

From our logs we can see that Saviynt is using port 8080 which (usually) means unencrypted HTTP traffic. Why is Saviynt not using encryption in transit as advertised?

[Rishi]

@Marcel which logs you are referring to where 8080 port is used, please provide more details. (remember to mask any PII data while providing details)

[Marcel]

Hi @Rishi ,

The logs I'm referring to are the Saviynt application logs. (Admin --> Admin Function --> Application logs)
Both ECM and Ingress-nginx tell me that port 8080 is used:

[Rishi]

These are internal communication between services - Internally micro services talk to one another in huge numbers per second which are non ssl but the traffic doesn't go outside cluster. Internal ms talks to each other on non-ssl port as certificate based encryption/decryption is not needed if the traffic is within cluster and if enforced, then there will be huge latency as encryption/decryption is a costly process. Any traffic that goes outside or comes inside cluster happens on ssl port only and is enforced at infra level.

[Marcel]

Then why is Saviynt advertising that all data in transit is encrypted? This is not how the product was sold to us!

[rushikeshvartak]

8080 port needs to be encrypyed ?

[Rishi]

This is communication between two services within the application. Any transaction data from application or to application are always encrypted.

As far as security is concerned this not cause any issue. Let us know if you have any follow-up question or concerns.

[Marcel]

You are claiming it is "not required", but it is being sold as "encrypted in-transit".
Even data in-transit between (micro)services should always be encrypted, as it still is an attack vector and we were promised that it would be encrypted.

If you are riding on a train from China to Finland, you don't want the carriage to suddenly disappear around you while in Russia. You are still moving, but don't have any protection against the bullets flying around.