Encrypting Data

A big part in how we keep data confidential is by the use of encryption. Encryption is used heavily nowadays. We use it in a lot of different scenarios.

Encryption is when we take something and encode it. We turn it into something else, something that's unrecognizable, and the only way that you can turn it back into its original form is by having a key or some sort of process that you go through to decode that. So in this case right here, we have the plain text secret and we're going to turn it into a cipher text, and that cipher text is then going to be unrecognizable by people unless they know how to decode it.

Now encryption has a cost as well, and the main cost of it is just performance, that it takes a while to encode things and then if you want to use it you have to decode it. So there's a performance issue if you're constantly encoding everything, or if you're encrypting everything. So we have to balance out the difference between performance and security.

At What Level Do We Encrypt?

Performance is one consideration when it comes to where we encrypt things, at what level do we encrypt things. We can encrypt things on a large scale or on a very minor scale. And if we encrypt things on a large scale, it could mean that we're going to have a performance hindrance with it. Or maybe it's all done with hardware, and all the encryption and decrypting is done on the hardware, and we might actually have some performance gains in that scenario.

So we could encrypt the whole disk. A disk is made up of partitions, or we can partition out a disk and have many partitions or volumes on a disk, so we could do it at the partition or volume level. Or we could do it on the file level, or on the block level. So we get to choose at what level we want to do this encryption on.

It's the same thing with databases. A database server could have many databases on it, and within those databases there could be many tables, and each one of those tables is going to have many different fields in them. And so the choice is going to be, do we want to do it on a database level and have a specific database that's encrypted, or do we want to do it on a table level and encrypt the whole table, or maybe we are just encrypting a column. So this would be a field in there, and there would be a certain type of data in there, maybe it's like an address, and do we want to just encrypt that one field that is right there for all of our users, or whatever data is being encrypted. So we could do it here again on a very large scale or a very small scale, depending on how granular we want to get with that and how secure we want to be and the performance hit.

The States of Data

So those are all examples of encrypting data at rest, but we also know we want to encrypt data in transit and in use as well. These are the different states of data, and we need to look at encryption in all of these scenarios right here.

A good example of encrypting data might be when we're doing some sort of authentication. When you are sending data from one device to another and you want it to be secure, we need to encrypt that data. So in this case right here, we have maybe some sort of form that we're filling out, and then we are going to encrypt that form and send the data across so no one can see what that form has involved in that. So that's an example of encrypting in transit.

There are times we may want to encrypt data that's also in use or in process. Essentially what's going to happen is this data is going to stay encrypted up until the point in time where it's actually being used. It will be decrypted, processed, and then encrypted again.

An example of where we might use something like this is on shared resources. There are times when you are using services like up in the cloud, where multiple tenants, multiple clients, multiple customers are all using the same piece of equipment. And for the most part you can't see each other's data, but there are times when that data can be leveraged if there's some sort of vulnerability in the system, that one client could see another client's processing and what's happening on the processor, or what's happening inside the memory. And so to guard against that, what we could do is we could decrypt things at the last second and then encrypt them when we're done with it. So what would happen is the encrypted information would get put onto the memory and then be sent to the CPU. The CPU would decrypt it, do the processing, encrypt it, and then put it back on the memory before it gets sent out to wherever it is going.

So essentially what we want to do is we want to look at the whole process of where data lives and where data is at. Data is at rest, and it goes into in transit, and then in use, and then maybe it goes in transit again and then in use again. Where do we encrypt this traffic and where do we decrypt it? It's going to have to be part of how we engineer our applications and how things are processed and wherever our data lives.