Encryption

One of the ways that we can protect our data is by encrypting it. That's when we take data and we change it or transform it into something that's unrecognizable, something that they can't get the original data out of unless they know the process to reverse that encryption, or what we call decrypting it.

Why Permissions Are Not Enough

Access control and permissions is one way that we can control access into a directory or into specific files, to control who has access to that file. There is a problem though. We know that the data is stored in a separate location for a file than the actual data of that file. The data for the file is stored in each of these little clusters here and can span across multiple clusters, but permissions could be stored in a whole other location. So what happens is somebody could mount that drive or access that drive somewhere besides just your computer, ignore the permissions, and go and read the data and then be able to capture the data from it. That is obviously problematic, because now they just bypass the permissions in order to see the data that you don't really want to have them have access to.

Encryption allows us to hide that information. So it still uses those clusters, but what we can do is we can take what we can read and be able to just see, and then we convert it into some sort of code that can't be read. In this example right here, we're taking plain text and we're converting it to some sort of cipher text. Whatever this is, that's just a series of ones and zeros that we can convert into something that you couldn't read unless you had the key or the way to decrypt that information.

Data at Rest and Data in Transit

We commonly think of where to encrypt as data at rest, things that are being stored, and data in transit, that is data that's being transmitted across a network. The way we approach these two different areas is going to be a little different. We also have something called data in process, but we're not going to address that because that's a little more rare of an occasion where we encrypt that information. So let's just talk about data at rest and data in transit.

Data at Rest

For data at rest, we have these disks, and we could encrypt the disk, or we could encrypt the partition, or we could encrypt the volume, we can encrypt the file, or we could encrypt at a block level. So we can just kind of choose where it is that we want to implement this encryption. At what level do we want to encrypt things at? And depending on which level we choose, it has its different pros and cons. For instance, if we encrypt a whole disk, it's going to take longer to access the data on that disk. However, if we just choose something on the other side, then that could leave us exposed to somebody being able to read data that we don't want to have them have access to.

There's a really basic form of encryption on Windows here. We can open up test here, and with test open, choose one of these files, right click on it and say properties, and go into the properties, and under here if we click on the Advanced tab right here, we can go into encrypt contents to secure data. So we could encrypt this. Now this is a real basic form of encryption, but it could be one step in protecting it. It gives us this little warning. I'm just going to encrypt this file as an example, and we'll click on okay, and we'll implement it on this file. So now this file is encrypted.

One thing that Microsoft Windows has done on their more recent Windows systems is they've turned on the volume encryption. It's called BitLocker. So your computer will automatically, by default nowadays, or at least on the newer versions of Windows, use volume level encryption to protect the data on that computer.

We're also seeing encryption come on by default for things like mobile devices. There are more and more mobile devices, things like phones or tablets or laptops or that type of thing, that come by default with encryption turned on, so that way you're protecting the data that exists on these devices.

Data in Transit

So we're better addressing data at rest, data that's actually in storage, and in rting that data, but we're also concerned about data in transit, things that are actually the bits that are moving across and translating that data that's carrying across different networks.

Examples of data that we would want to have encrypted in transit would be things like our email. A lot of times we don't want our email to be read by others. Or when we're going to different sites, like let's say our banking site, so we have a protocol, HTTPS, that helps secure all of the web traffic that's going across our machine. And then we have our mobile apps, the different apps that we're using on our devices that we are locking down and securing all that data in transit as well.

Virtual Private Networks

Another thing that's become a lot more prevalent now that we do a lot more working from home and working remotely is something called virtual private networks. We have a network of machines at work, so that way we can access different resources within that network. However, when you work from home, you still need access to things to do your job.

What happens is that if we were to just communicate across the internet with just clear text, then anybody could see that traffic, and that would compromise any communication that's going between your machine and the rest of your company's network. So what happens is we set up a virtually private network, a VPN, a virtual private network, and what that does is it encrypts the traffic between your machine and this network so no one else can see it. So essentially you are becoming part of your company's network, but it's virtually private. Virtually, people could still see that traffic, but it's just encrypted, so they can't interpret what that traffic actually looks like.

Now the topic of encryption goes way more beyond what we just covered, but this gives you just an idea of how we protect our data and how we protect our data at rest and in transit.