Where Should It Be Encrypted?

About this interactive

Encryption turns plaintext into ciphertext that only the key turns back. The Encrypting Data lesson says its main cost is performance: encoding and decoding take work, so security has to be balanced against speed. At rest, you choose the scale. On a disk: the whole disk, a partition or volume, a file, or the block level. In a database: the whole database, one table, or just one column, such as the address field for every user. A larger scale protects more but can cost more performance (unless hardware does the work). So when everything on a device needs protecting, as on a laptop that could be stolen, encrypt the whole disk. When one file or one column is sensitive and the rest is busy or harmless, encrypt just that. In transit, data is encrypted as it travels, such as a login form sent to a server. In use, the data stays encrypted until the moment it is processed: decrypted on the processor, worked on, encrypted again. The lesson's example is a shared cloud server, where another tenant might find a way to look into memory. A quick test for each card: is the data stored, moving or being processed, and if stored, how much of it is sensitive?

What you'll learn

Choose the level or state of encryption that fits a need: the whole disk, one file or one database column at rest, or the data in transit or in use
Recognize the trade-off the lesson names: encrypting at a larger scale costs more performance, so encrypt at the level the need calls for

Aligned to

CompTIA Security+

1.4 Explain the importance of using appropriate cryptographic solutions.

3.3 Compare and contrast concepts and strategies to protect data.

NIST 800-53

SC-13 Cryptographic Protection

ISC2 CISSP

3.6 Select and determine cryptographic solutions

Key terms

Encryption: The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
Full Disk Encryption: Full Disk Encryption is a method of encrypting all data on a storage device at the hardware or software level, ensuring that data remains inaccessible if the device is lost or stolen without the proper authentication credentials or decryption key.
Data at Rest: Data that is stored on a device or medium and not actively moving through a network, which can be encrypted at the disk, partition, volume, file, or database level.
Data in Transit: Data that is actively moving across a network or communication channel between two endpoints, as opposed to data sitting on a storage device. Protocols such as TLS are commonly used to encrypt data in transit so it cannot be read if intercepted.
Data in Use: Data actively being processed or accessed, such as data moving through a processor or physically reviewed, which must be secured against unauthorized exposure.

Topics

Encryption Data States Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →