Confidentiality - Encrypting Data

Where We Encrypt

Encryption is one way that we can keep things confidential, but it comes at a cost. There's some processing power that we use up by encrypting things. It used to be that we were very selective in what we encrypted, but because it's become a top priority for many companies and a really hot topic, we're starting to encrypt more and more things.

In looking at our cybersecurity cube, we see some places where we may want to consider encrypting. That is, we may want to consider at rest, in process, and in transit encryption.

The thing is, when we encrypt things, it does come at a cost. There's a performance cost — it takes processing power to be able to encrypt and decrypt things. So when we roll out encryption, if we were to just roll it out on everything, there could be a performance hit. So there are some considerations when balancing between performance and security.

At Rest

Since there's this balancing act, we need to decide at what level we're going to actually encrypt. At rest is a great example of deciphering which level we want to encrypt at. At rest just means the data is being stored somewhere.

First of all, we can do it at a disk level, where we encrypt the whole disk and you can't access anything on the disk unless you have the key. Disks are made up of partitions — you could have just a single partition or maybe a few partitions on a disk — and we can encrypt things at a partition level. Or that can be broken down into volumes: we can have multiple volumes on a partition, and so there is volume level encryption. BitLocker is an example — that's one of Microsoft's ways of encrypting the information, by doing a volume level encryption on it.

Then you could choose just single files out of there on that disk, certain files that you want to encrypt, or there might be blocks of the files that you want to encrypt. So there is a level at which you're going to do it.

Same thing with a database. We could encrypt the whole database, or we could encrypt a record out of that database. So we could just do a single record, or we could choose certain fields or tables that we want to encrypt.

In Process

There's also encryption in process. This could be when somebody's entering data and you want to encrypt things right away, or it could be when things are actually getting processed on a processor, which can be very tricky. What you would do is have it encrypted sitting in memory and then have to decrypt it to actually process it. Obviously there's a high load on the CPU to do this, and it's quite a bit more tricky, so it's not as common.

In Transit

We certainly want to think about in transit as well, especially if it's going across the internet. One real common way that we do this encryption across the internet, and through a lot of different means, is we use TLS, which is the newer version of SSL. SSL was one of the older versions that we used to use, but it's considered insecure, so now we use TLS.

Types of Encryption

There are actually a lot of different types of encryption. The two major categories are symmetric key encryption and asymmetric key encryption, and here are some examples of both of those. Depending on what we're applying it to, we might choose one or the other type of encryption.

We also have things that are closely related to encryption, like hashing. It all falls under the umbrella of cryptography, but hashing serves a little different purpose. Hashing is usually when we are trying to implement things like integrity, versus encryption, which is when we're trying to implement things like confidentiality.

Not all encryption is the same, though. For instance, we came out with DES in the past, but at some point in time we were able to start hacking DES and it became insecure, and so we no longer want to use DES, and instead we use AES. There are even different weaknesses with AES as well, depending on the strength that you want with AES — you can select different levels with that. So not all encryption is the same, and we have to know that there are some encryption algorithms that are weaker and some that are stronger, and there are some that are purpose-built for certain specific purposes. So we may choose a lot of these different types of encryption and these different encryption algorithms based off what our use case is, and then there are times that we need to update that, because new standards come out.

Encryption in Protocols

Another area that we use this encryption is with protocols. Protocols are all around communication. When a computer is communicating to another computer, they use protocols — that's a set of rules and standards that allow that communication to happen. Within those protocols, it can use different levels of encryption, and so we might specify what level of encryption we want with the protocols that we're using.

One example of that is TLS. We use transport layer security, which uses various types of encryption and encryption algorithms to encrypt traffic that historically has not been encrypted. For instance, web traffic — old web traffic used to operate off of HTTP. It's no longer really something that we try to do and try to use; instead, we try to use HTTPS, which is the secure version. It uses TLS to encrypt that traffic and send it across. So TLS is a protocol that helps us encrypt our traffic, keeping it confidential in transit.