1 1 00:00:00,150 --> 00:00:01,410 Encryption. 2 2 00:00:01,410 --> 00:00:04,110 In this lesson, we are going to focus on encryption. 3 3 00:00:04,110 --> 00:00:05,760 Now, we're not going to do a full review 4 4 00:00:05,760 --> 00:00:07,590 of all the different encryption types, 5 5 00:00:07,590 --> 00:00:09,000 because you should already know that 6 6 00:00:09,000 --> 00:00:10,560 from Security Plus. 7 7 00:00:10,560 --> 00:00:13,020 Instead, I want to focus on more of the concepts 8 8 00:00:13,020 --> 00:00:15,870 around encryption as opposed to the specific methods 9 9 00:00:15,870 --> 00:00:20,870 of encryption like AES or WPA2 or RC4, or things like that. 10 10 00:00:21,540 --> 00:00:23,010 So as we talk about encryption, 11 11 00:00:23,010 --> 00:00:24,810 we want to remember that encryption is used 12 12 00:00:24,810 --> 00:00:26,500 to secure our information. 13 13 00:00:26,500 --> 00:00:29,250 And this can be done for lots of different data states. 14 14 00:00:29,250 --> 00:00:31,200 And we talked about the three data states before 15 15 00:00:31,200 --> 00:00:32,400 and we're going to dig a little deeper 16 16 00:00:32,400 --> 00:00:34,050 into those in this lesson. 17 17 00:00:34,050 --> 00:00:36,630 Now, encryption is a form of risk mitigation 18 18 00:00:36,630 --> 00:00:39,030 for access controls, because if I have 19 19 00:00:39,030 --> 00:00:41,850 some kind of access control, like file system permissions, 20 20 00:00:41,850 --> 00:00:43,890 but somebody can still get that file, 21 21 00:00:43,890 --> 00:00:45,900 because we screwed that up, well, 22 22 00:00:45,900 --> 00:00:47,070 if we encrypted that file, 23 23 00:00:47,070 --> 00:00:48,450 they still won't be able to read it. 24 24 00:00:48,450 --> 00:00:50,790 And so this is a great form of risk mitigation, 25 25 00:00:50,790 --> 00:00:53,323 both on the network and for your storage. 26 26 00:00:53,323 --> 00:00:55,920 Now, as I said, there are three different data states 27 27 00:00:55,920 --> 00:00:57,180 that we need to talk about. 28 28 00:00:57,180 --> 00:00:59,700 We're going to talk about data at rest, data in transit 29 29 00:00:59,700 --> 00:01:01,170 and data and use. 30 30 00:01:01,170 --> 00:01:02,760 Now, when we talk about data at rest, 31 31 00:01:02,760 --> 00:01:05,160 this is inactive data that's stored physically 32 32 00:01:05,160 --> 00:01:06,539 in any digital form. 33 33 00:01:06,539 --> 00:01:08,820 So if I have data sitting on a hard drive, 34 34 00:01:08,820 --> 00:01:10,170 that is data at rest 35 35 00:01:10,170 --> 00:01:11,970 and it is vulnerable just sitting there. 36 36 00:01:11,970 --> 00:01:13,350 So I want to make sure I encrypt it. 37 37 00:01:13,350 --> 00:01:15,030 So if anybody steals that hard drive 38 38 00:01:15,030 --> 00:01:16,440 or is able to read from it, 39 39 00:01:16,440 --> 00:01:17,880 they wouldn't be able to read the data 40 40 00:01:17,880 --> 00:01:18,930 because it would be encrypted 41 41 00:01:18,930 --> 00:01:20,550 and they wouldn't have the key. 42 42 00:01:20,550 --> 00:01:23,580 Now, data at rest is protected by whole disk encryption, 43 43 00:01:23,580 --> 00:01:26,719 database encryption, file encryption, or folder encryption. 44 44 00:01:26,719 --> 00:01:29,761 If you can encrypt the data that's stored on the disk 45 45 00:01:29,761 --> 00:01:32,791 in a file system in a folder or in a database, 46 46 00:01:32,791 --> 00:01:34,680 that is going to protect your data 47 47 00:01:34,680 --> 00:01:36,360 when you're dealing with data at rest. 48 48 00:01:36,360 --> 00:01:38,790 Now, the second one we have is data in transit, 49 49 00:01:38,790 --> 00:01:40,890 also known as data in motion. 50 50 00:01:40,890 --> 00:01:41,970 And I've talked about this before, 51 51 00:01:41,970 --> 00:01:44,370 that this is data that's actively being transmitted 52 52 00:01:44,370 --> 00:01:45,630 over the network. 53 53 00:01:45,630 --> 00:01:48,090 So if I'm taking data from my web server 54 54 00:01:48,090 --> 00:01:51,000 and sending it to your client computer over the internet, 55 55 00:01:51,000 --> 00:01:52,350 that is data in transit 56 56 00:01:52,350 --> 00:01:53,940 and we want to be able to protect that. 57 57 00:01:53,940 --> 00:01:55,020 So how do we do that? 58 58 00:01:55,020 --> 00:01:57,778 Well, we do it using transport encryption protocols. 59 59 00:01:57,778 --> 00:02:00,742 That could be something like IPSec if you're using VPNs, 60 60 00:02:00,742 --> 00:02:03,690 TLS, if you and I are connecting over to the web 61 61 00:02:03,690 --> 00:02:06,839 or WPA2, if we're trying to encrypt your local area network 62 62 00:02:06,839 --> 00:02:08,880 and the wifi connection there. 63 63 00:02:08,880 --> 00:02:10,050 There's lots of different types of 64 64 00:02:10,050 --> 00:02:11,730 data in transit encryptions, 65 65 00:02:11,730 --> 00:02:12,660 but you just want to remember, 66 66 00:02:12,660 --> 00:02:14,250 when you're dealing with transport encryption 67 67 00:02:14,250 --> 00:02:16,710 and you're trying to protect that data as it's moving. 68 68 00:02:16,710 --> 00:02:19,041 That's what we're talking about with data in transit. 69 69 00:02:19,041 --> 00:02:21,914 Now, the next one we want to talk about is data in use. 70 70 00:02:21,914 --> 00:02:24,630 And data in use is the active data 71 71 00:02:24,630 --> 00:02:26,997 which is stored in a non-persistent digital state, 72 72 00:02:26,997 --> 00:02:30,750 typically in a computer's random-access memory, the RAM 73 73 00:02:30,750 --> 00:02:33,665 or the CPU caches or the CPU registers. 74 74 00:02:33,665 --> 00:02:37,410 Essentially, this is data that is actively being worked on. 75 75 00:02:37,410 --> 00:02:39,570 So if I had a file on the hard drive, 76 76 00:02:39,570 --> 00:02:41,670 it might be encrypted that's data at rest. 77 77 00:02:41,670 --> 00:02:44,040 But, when the computer wants to work on that, 78 78 00:02:44,040 --> 00:02:46,860 it has to open it, it's going to decrypt that file, right 79 79 00:02:46,860 --> 00:02:48,390 and load it into memory. 80 80 00:02:48,390 --> 00:02:50,430 At that point, it's now vulnerable again. 81 81 00:02:50,430 --> 00:02:51,992 So, how can I protect it? 82 82 00:02:51,992 --> 00:02:54,180 Well, the best way to protect data 83 83 00:02:54,180 --> 00:02:56,220 when it's in use is to be able to protect it 84 84 00:02:56,220 --> 00:02:58,470 using secure processing mechanisms. 85 85 00:02:58,470 --> 00:02:59,430 And we talked about this 86 86 00:02:59,430 --> 00:03:01,380 back when we talked about hardware security 87 87 00:03:01,380 --> 00:03:02,820 and the root of trust. 88 88 00:03:02,820 --> 00:03:05,010 We talked about the fact that AMD and Intel, 89 89 00:03:05,010 --> 00:03:07,094 both have secure processing mechanisms 90 90 00:03:07,094 --> 00:03:09,030 inside their processors now, 91 91 00:03:09,030 --> 00:03:11,400 to help protect the data when it's in the motherboard, 92 92 00:03:11,400 --> 00:03:13,750 when it's in RAM or when it's in the processor.