Instructor: Encryption. 2 2
In this lesson, we are going to focus on encryption. 3 3
Now, we're not going to do a full review 4 4
of all the different encryption types, 5 5
because you should already know that 6 6
from Security Plus. 7 7
Instead, I want to focus on more of the concepts 8 8
around encryption as opposed to the specific methods 9 9
of encryption like AES or WPA2 or RC4, or things like that. 10 10
So as we talk about encryption, 11 11
we want to remember that encryption is used 12 12
to secure our information. 13 13
And this can be done for lots of different data states. 14 14
And we talked about the three data states before 15 15
and we're going to dig a little deeper 16 16
into those in this lesson. 17 17
Now, encryption is a form of risk mitigation 18 18
for access controls, because if I have 19 19
some kind of access control, like file system permissions, 20 20
but somebody can still get that file, 21 21
because we screwed that up, well, 22 22
if we encrypted that file, 23 23
they still won't be able to read it. 24 24
And so this is a great form of risk mitigation, 25 25
both on the network and for your storage. 26 26
Now, as I said, there are three different data states 27 27
that we need to talk about. 28 28
We're going to talk about data at rest, data in transit 29 29
and data and use. 30 30
Now, when we talk about data at rest, 31 31
this is inactive data that's stored physically 32 32
in any digital form. 33 33
So if I have data sitting on a hard drive, 34 34
that is data at rest 35 35
and it is vulnerable just sitting there. 36 36
So I want to make sure I encrypt it. 37 37
So if anybody steals that hard drive 38 38
or is able to read from it, 39 39
they wouldn't be able to read the data 40 40
because it would be encrypted 41 41
and they wouldn't have the key. 42 42
Now, data at rest is protected by whole disk encryption, 43 43
database encryption, file encryption, or folder encryption. 44 44
If you can encrypt the data that's stored on the disk 45 45
in a file system in a folder or in a database, 46 46
that is going to protect your data 47 47
when you're dealing with data at rest. 48 48
Now, the second one we have is data in transit, 49 49
also known as data in motion. 50 50
And I've talked about this before, 51 51
that this is data that's actively being transmitted 52 52
over the network. 53 53
So if I'm taking data from my web server 54 54
and sending it to your client computer over the internet, 55 55
that is data in transit 56 56
and we want to be able to protect that. 57 57
So how do we do that? 58 58
Well, we do it using transport encryption protocols. 59 59
That could be something like IPSec if you're using VPNs, 60 60
TLS, if you and I are connecting over to the web 61 61
or WPA2, if we're trying to encrypt your local area network 62 62
and the wifi connection there. 63 63
There's lots of different types of 64 64
data in transit encryptions, 65 65
but you just want to remember, 66 66
when you're dealing with transport encryption 67 67
and you're trying to protect that data as it's moving. 68 68
That's what we're talking about with data in transit. 69 69
Now, the next one we want to talk about is data in use. 70 70
And data in use is the active data 71 71
which is stored in a non-persistent digital state, 72 72
typically in a computer's random-access memory, the RAM 73 73
or the CPU caches or the CPU registers. 74 74
Essentially, this is data that is actively being worked on. 75 75
So if I had a file on the hard drive, 76 76
it might be encrypted that's data at rest. 77 77
But, when the computer wants to work on that, 78 78
it has to open it, it's going to decrypt that file, right 79 79
and load it into memory. 80 80
At that point, it's now vulnerable again. 81 81
So, how can I protect it? 82 82
Well, the best way to protect data 83 83
when it's in use is to be able to protect it 84 84
using secure processing mechanisms. 85 85
And we talked about this 86 86
back when we talked about hardware security 87 87
and the root of trust. 88 88
We talked about the fact that AMD and Intel, 89 89
both have secure processing mechanisms 90 90
inside their processors now, 91 91
to help protect the data when it's in the motherboard, 92 92
when it's in RAM or when it's in the processor.