Why Encrypt Data

Why We Encrypt, and What It Costs

Encryption is one way that we can keep things confidential, but it comes at a cost: there's some processing power that we use up by encrypting things. It used to be that we were very selective in what we encrypted, but because it's become a top priority for many companies and a really hot topic, we're starting to encrypt more and more things.

Looking at our Cybersecurity Cube, we see some places where we may want to consider encrypting. That is, we may want to consider at rest, in process and in transit encryption. The thing is, when we encrypt things it does come at a cost. There's a performance cost — that is, it takes processing power to be able to encrypt and decrypt things. So when we roll out encryption, if we were to just roll it out on everything, there could be a performance hit. So there are some considerations when balancing between performance and security.

Encryption at Rest

Since there's this balancing act, we need to decide at what level we're going to actually encrypt at. At rest is a great example of deciphering which level we want to encrypt at. At rest just means the data is being stored somewhere. First of all, we can do it at a disk level, where we encrypt the whole disk and you can't access anything on the disk unless you have the key. Disks are made up of partitions — you could have just a single partition, or maybe a few partitions on the disk — and we can encrypt things at a partition level. Or that can be broken down into volumes: we can have multiple volumes on a partition, and so there is volume level encryption. BitLocker is an example. That's one of Microsoft's ways of encrypting the information, by doing a volume level encryption on it. Then you could choose just single files out of there on that disk, certain files that you want to encrypt, or there might be blocks of the files that you want to encrypt. So there is a level in what you're going to do.

Same thing with a database. We can encrypt the whole database, or we could encrypt a record out of that database, so we could just do a single record, or we could choose certain fields or tables that we want to encrypt.

In Process and In Transit

There's also encryption in process. This could be when somebody's entering data and you want to encrypt things right away, or it could be when things are actually getting processed on a processor, which can be very tricky. What you would do is you would have it encrypted sitting in memory and then have to decrypt it to actually process it. Obviously there's a high load on the CPU to do this, and it's quite a bit more tricky, so it's not as common.

We certainly want to think about in transit as well, especially if it's going across the internet. One real common way that we do this encryption across the internet, and through a lot of different means, is TLS, which is the newer version of SSL. SSL was one of the older versions that we used to use, but it's considered insecure, so now we use TLS.