When it comes to data security,
one of the most tried and true methods
is to use data encryption.
Now in this lesson, we're not going to do a full review
of all the different encryption types.
Instead, we're going to focus our efforts on the concepts
surrounding encryption, as opposed
to the specific technical implementations
and algorithms like DES, IDEA, or AES.
We're going to talk about two different types
of data in your systems, unencrypted and encrypted,
and the three different data states
that information may pass through
during its creation, usage, and storage.
First, it's important to remember
that data can be in your systems
and exist as either unencrypted or encrypted data.
Now, unencrypted data is any data
that remains in an easily viewable or accessible format.
This is also known as clear text or plain text data.
This data is stored, transmitted,
or processed in an unprotected format
that anyone can view and read.
For example, if I'm using the network
to transmit my username
and password in an unencrypted format,
such as when I log into a Telnet server,
that is considered open and available to anybody
who happens to be capturing the packets
as they're going across that network.
To secure my data in any of its states,
such as when the data is at rest, the data is in motion,
or the data is in processing, you need to encrypt that data.
Now, data encryption is a security method
where information is encoded.
It can only be accessed
or decrypted by a user with a correct security key.
There are many different ways to encrypt and decrypt data,
but for now, just remember
that encrypted data is scrambled up
and unreadable to anybody
without the proper encryption or decryption key.
This scrambled up data is known simply as encrypted data
or cipher text data when it's in this scrambled form.
When it comes to encryption,
remember, it is a form of risk mitigation
for the access controls used in your system.
If an attacker's able to circumvent your access controls
and gain access to a file,
but that file is encrypted, well guess what?
That attacker still can't read it.
This is what makes encryption
a great risk mitigation to use
in order to protect the confidentiality of your data,
even if other things fail.
There are going to be three different data states
the data and information can continually move between.
Now, when we talk about a data state,
we're talking about the location
of the data within the processing system.
Data can really exist in only one of three places.
You can have data at rest, data in motion,
or data in processing.
First we have data at rest.
Data at rest is any data
that is stored in memory, on a hard drive,
or on a storage device.
For example, if I have data
simply sitting on an external hard drive,
that data could be vulnerable.
To protect that data, I might want to use BitLocker
to perform a full disc encryption
of that external hard drive,
or I might use file level encryption
to protect just the specific files
and folders that I need to protect.
Either way, if I encrypt the critical data
that's stored on that hard drive,
I can ensure that no one can read
that contents of those files
unless they have the decryption key,
and therefore, I'm going to be ensuring confidentiality.
Now, there are many different types of encryption used
to support the confidentiality of data at rest.
This includes full disc encryption, folder encryption,
file encryption, or database encryption.
The second type of data state we have
is known as data in transit or data in motion.
Data in motion is any data
that's currently moving from one computer
to another over the network
or from one part of the computer system
to another part of the computer system
within the same tower.
This could be from the hard disk to the memory
or from the memory to the processor.
All of these are examples of data in transit
or data in motion.
Now, let's take another example.
Let's say I want to access my bank's web server
and I need to log in there.
I need to send them data like my username
and password in order to be authenticated by their systems.
So to secure the communication path between my laptop
and their web server, I need to rely on some form
of a transport encryption protocol.
In the example of logging into a bank account
over their website, I'm likely going to rely
on TLS, transport layer security,
or SSL, secure socket layer.
Both of these are commonly used
to protect the transport layer of a web application.
Now, if I'm connecting my laptop back
to my corporate network over a VPN connection,
I might use something like IPSec
or layer two tunneling protocol.
If I'm trying to secure the wireless connection
between my laptop and my home wireless access point,
I might use WPA2 with AES encryption as my algorithm.
Regardless of the exact technology in use,
our goal is always the same.
We want to protect the data
and maintain its confidentiality
as it's moving from one system like my laptop
to another system like the bank's website
or over to the internet by adding
a layer of encryption to it.
The third data state we have
is known as data in use or data in processing.
Now, data in use or data in processing is any data
that has been read into memory
or is currently inside the processor
and is currently being worked on or manipulated.
This is active data
that is non persistent in its digital state.
Typically, it's being held in random access memory,
or RAM, inside your system, or it's in the CPU's caches
or the CPU's registers.
This is data that's currently being utilized by the computer
and its central processing unit.
So remember, your data state for any piece of data
can be either at rest, in motion,
or in processing at any given time.
And these data states change as the data is created,
processed, and stored within a given system or network.
Let me give you a quick example of this
to tie it all together.
Let's pretend I have a file on my hard drive
with a list of all my students
who have passed their certification exams.
Now I want to maintain the confidentiality of that file,
so I might encrypt it using the AES algorithm
and use a long, strong symmetric encryption key.
This file is now being protected when it's at rest
using data at rest,
and stored in this encrypted cipher text format.
But there is one person on my team
who needs to read the contents of that file
to determine if Jane Doe has really passed
her certification exam or not.
So I enter the decryption key
and that file is converted back to plain text.
Now, I find the line that has Jane Doe's name and status,
and I want to send this securely to a team member.
I can save this line to a file, encrypt that file,
and then send that file over.
But that's a bit cumbersome.
So instead, I'm going to open a direct message
with them using Slack.
Now I'm logged into the Slack website
using the HTTPS protocol, so that data being sent
from my computer to the Slack server
is being encrypted using TLS or SSL,
ensuring that the data is encrypted
as it becomes data in transit or data in motion.
Once that data is received by my team member,
they could put it into a file and encrypt it
and make it data at rest again,
or they can simply delete the message
since they now have the information they needed
and they can get rid of that data.
All the while when I access that file on my computer
or begin to send that information over the network,
that data moved from data at rest
to data in transit, and between those two states,
the data was also in use
because my CPU had to perform the operations on that data
as part of the encryption and decryption process,
as well as the transmitting and receiving process.
To help protect that data while it's being processed
as data in use, AMD and Intel processors involve the use
of secure processing mechanisms with encryption
and integrity checks as appropriate.
So as you can see, data is not just in one state.
It moves constantly between these different states
continually from data at rest
to data in transit and data in use,
and you must consider how it's going to be protected
during each of these data states.