Encryption is a foundational security control applied to data in three states: at rest, in transit, and in use. Understanding where and at what level to encrypt data helps balance security strength with system performance.
When we're architecting security, another thing that we're going to probably want to include, or at least consider, is encryption.
When it comes to data, there's three different states: data at rest, data in transit, and data in use.
Data at rest means that the data is not moving — that means that it is stored. So this is a data store. Maybe this is a disk, maybe it's a database, whatever the case may be, it's in a stored state, and when it's in this stored state we call it data at rest. A lot of times we're going to want to encrypt that data at rest. The biggest reason is that if this data were to ever be compromised and somebody broke into our system, they could steal the data when it is data at rest. We want to make sure that if they were to steal that data, they couldn't decrypt it and be able to see what it is.
Another state of data is data in transit. This is when data is going across our network, when it's going from one location to another location. This is really critical because these lines might not be secure, so the data is very vulnerable at this point — vulnerable to some sort of integrity attack, where somebody could change that data, or vulnerable to somebody being able to look at that data and we have a confidentiality breach. So it's going to be really important for us to encrypt this data. Almost always we want to encrypt this data, especially if it's out there in the public going across the internet, but even if it's local we probably want to encrypt this. Just think: if we have our username and password and we type that in, and then it goes across this wire and somebody's sniffing that wire, they can see that username and password. So we want to avoid that.
Then there's data in use. This is when we're actually doing the processing of that data. So if it's going across the processor, or we're using it within one of the servers — and it doesn't necessarily even need to be digital. If it's lying on my desk because I took it out of the lock box and now I'm looking at that data and I leave it exposed on the table, that would count as well. So wherever we're using this data, we want to make sure that it's encrypted and secure.
I like to think of this as there being different levels. There's an object level, so we can encrypt the object. If this is sensitive information right here, that's where we could encrypt this. And then there's a container, which could store lots of different objects. When we're just encrypting the object, we're just encrypting the object that needs to be secure. From a container standpoint, this is whatever is holding that data, and it's holding other data as well — maybe stuff that does not need to be encrypted — or the whole storage altogether. So there's different levels: we could do all of the storage, we could do some of the containers within the storage, or we could do the objects within those containers.
What does this look like? Let's take it at rest. An example of this: we could do it at the disk level, or the partition level, or the volume level. I'd consider all these at the storage level. Or we could go and do it at the container level, which would be the folder level. Or we could do it at the file level — that's the object. Or we could get even smaller and do it at a block level right there.
When it comes to databases, we could do it at the database level. Or we could do it at the table level, since tables are inside of databases. A database holds a lot of different tables, and those tables have different fields, so we could also do it at the field level.
With data in transit, we could be encrypting most of the IP packet here. We do that with something like IPsec. Or we could be doing it within the payload, encrypting the payload, or there could be just portions of the payload that we would encrypt.
What are the advantages and disadvantages to all of these? First of all, anytime we encrypt things, it's going to take a payload on whatever is doing the processing of that encryption. So if we're encrypting more, that means that there's going to be more resources needed to do that encryption and decryption. If we do it at a storage level, this is going to be lower performance — there's going to be a performance hit on that — versus just doing it at the object, which is going to be better performance.
So why would we not just do it all on the object level? Well, there are times that maybe we missed encrypting an object. If we do it at the storage level or the container level, then we don't miss certain objects, and that could be sensitive information that doesn't get encrypted. Or even if we are thorough and make sure that we got all of the objects, there's still surrounding information that could become sensitive either in the future, or that an adversary could use to carry out an attack. So we would consider doing it at the object level a little less secure, and doing it at the storage level or at an upper level there more secure.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →