In today’s world of data breaches and increasingly stringent data protection regulations, it’s more important than ever to make sure your sensitive data is secure. This is especially true for Oracle Documaker Standard Edition (ODSE), which often handles Personally Identifiable Information (PII) and other sensitive data during document processing. If you’re working with ODSE and dealing with intermediary files that contain PII, encrypting your data while it’s at rest is a must. So, let’s break down what this means, why it matters, and how to make sure you’re keeping your data as safe as possible.

What Is Data Encryption at Rest?

First things first, let’s talk about data encryption at rest. This means that data is encrypted when stored internally, such as a hard disk or solid state storage device. A key point is "at rest" — this means that the data is in a final state, e.g. written to a file, and not in transit such as moving through a network. And encryption, as you might guess, means that the data is scrambled in such a way that it can only be read using a specific decryption key.

Why do we need this? Well, imagine an unauthorized person gains access to your file system. Without encryption, they could simply read any file on the system, including files that contain PII like names, addresses, Social Security numbers, passwords, credit card numbers, birthdates, the list of potential names for your next cat, and more. But with encryption, even if someone manages to access those files, all they’ll see is scrambled data that they can’t interpret – they'll never know you wanted to name that cat Herman.

How Oracle Documaker Works with Intermediary Files

In ODSE, intermediary files are used during document generation workflows. These files temporarily hold data being processed between different steps—such as sorting, formatting, or combining data from multiple sources. If these intermediary files contain PII—and often they do, since documents may output personal details—those files need to be properly secured. ODSE doesn’t handle encryption of these files itself; this means that the responsibility falls on you to ensure that these intermediary files are encrypted while they’re at rest. This is where file system encryption comes in.

Full Disk Encryption: Transparent Security

All supported operating systems for ODSE provide support for file system encryption, whether it is an entire disk, or specific directories. If you're using Oracle Linux or an equivalent distribution for your Documaker system, you can set up file system encryption using tools like LUKS (Linux Unified Key Setup) or dm-crypt. These tools provide full disk encryption — all the files on your system will be automatically encrypted as they’re written to the disk. And when an application like Oracle Documaker writes to an intermediary file, that file will be encrypted without the application even needing to know about it. Windows has BitLocker, a built-in tool that provides similar functionality for full disk encryption. 

These options are great because they make encryption transparent to your applications. You  don’t need to modify ODSE or any other applications you’re using: the encryption layer is handled by the operating system, and ODSE will continue running smoothly as it writes and reads from the disk, without any extra configuration needed from your end.

Options Beyond Full-Disk Encryption

Instead of encrypting the entire disk, you can focus on encrypting only the directories where intermediary files are stored, such as those used by ODSE for document processing. 

On Windows, you can use Encrypting File System (EFS) for directory-level encryption. With EFS, you can specify that only certain folders (like those used for intermediary Documaker files) should be encrypted, without the need for full-disk encryption. EFS is integrated into the Windows operating system, so it’s easy to configure and doesn’t require third-party tools. However, make sure to backup encryption keys in case you need to recover encrypted files!

On Linux, you can use eCryptfs or fscrypt to encrypt specific directories or files:

  • eCryptfs is a stackable cryptographic file system that allows you to encrypt individual directories on your file system. It is particularly useful when you want to selectively encrypt data without the overhead of full-disk encryption.
  • fscrypt offers file system-level encryption and can be configured to automatically encrypt specific directories in Linux systems.

These methods allow you to encrypt only the parts of the system where PII is stored, ensuring that the rest of the file system remains unencrypted and thus more efficient.

Performance Considerations and How to Mitigate Them

Encryption always comes with a performance cost. When you encrypt data, especially on the fly as it’s being written to or read from disk, there is always some overhead that can impact system performance. Here's some information that is good to know:

1. Disk I/O Overhead

Encryption and decryption can add extra CPU and disk I/O usage, as every time a file is written to or read from disk, it must be encrypted or decrypted. The more files you’re processing at once, the more noticeable the performance hit. Consider staggering or batching document processing workflows to avoid overloading the system at peak times. Additionally, ensure that your hardware (especially CPU performance) is capable of handling encryption without slowing down the rest of the system. Also consider what you're encrypting: if you're doing full-disk encryption, you may be making more work for the system to encrypt files that will never contain sensitive information, such as operating system binary files.

2. File-Level Encryption Overhead

If you’re encrypting specific directories or files (rather than the entire disk), you’re introducing additional complexity to your system. This can result in longer processing times as data is encrypted and decrypted during each workflow step. To mitigate this, focus on optimizing file usage and encryption: don't encrypt files and directories that will never contain PII, and don't generate files if you don't have to (this pertains specifically to single-step versus multi-step Documaker configurations).

3. Compression and Encryption

When dealing with encrypted files, compression becomes more challenging. Encrypted files are already in a scrambled format, which makes them hard to compress. Be sure to compress files prior to encryption, if possible. This can improve both performance and storage efficiency.

The Bottom Line: Protect Your Data with Encryption

If your Documaker configuration involves intermediary files containing PII, encrypting the file system is a best practice to ensure that this data is secure while at rest. File system encryption on Oracle Linux and Windows is relatively straightforward to implement and ensures that ODSE can continue operating without needing to be aware of encryption.

Remember, data security isn’t just about protecting data from cyber-attacks; it’s about ensuring compliance with laws and regulations (think GDPR, HIPAA, etc.) and maintaining the trust of your customers. By taking the time to enable file system encryption, you’re not only safeguarding your sensitive data but also showing your commitment to security.

So, if you’re working with Oracle Documaker and PII, make sure encryption is part of your plan. It’s the best way to protect your data—and your reputation.