1
00:00:00,000 --> 00:00:01,589
In this lesson, we're going to discuss

2
00:00:01,589 --> 00:00:03,420
some various encryption tools that are employed

3
00:00:03,420 --> 00:00:05,820
to protect our enterprise networks and systems.

4
00:00:05,820 --> 00:00:09,780
These encryption tools include things like the TPM, HSM,

5
00:00:09,780 --> 00:00:12,300
key management systems, and secure enclaves.

6
00:00:12,300 --> 00:00:14,250
And all of these play a crucial role in ensuring

7
00:00:14,250 --> 00:00:16,680
the data security and integrity that is occurring

8
00:00:16,680 --> 00:00:19,650
across all of our different platforms and environments.

9
00:00:19,650 --> 00:00:23,880
First, let's talk about TPM, or the trusted platform module.

10
00:00:23,880 --> 00:00:27,060
At its core, the trusted platform module, or TPM,

11
00:00:27,060 --> 00:00:29,670
is a dedicated microcontroller that's designed to secure

12
00:00:29,670 --> 00:00:32,369
hardware through integrated cryptographic keys.

13
00:00:32,369 --> 00:00:35,730
TPMs are going to offer hardware level security that ensures

14
00:00:35,730 --> 00:00:38,790
that digital secrets remain confidential and unaltered.

15
00:00:38,790 --> 00:00:40,800
Think of it as a vault that ensures the information

16
00:00:40,800 --> 00:00:42,840
is remaining encrypted, so that the system remains

17
00:00:42,840 --> 00:00:46,260
safeguarded from unauthorized access or potential tampering.

18
00:00:46,260 --> 00:00:48,750
One of the common uses of the trusted platform module

19
00:00:48,750 --> 00:00:50,760
is with the BitLocker drive encryption feature

20
00:00:50,760 --> 00:00:53,160
found inside of your Windows operating system.

21
00:00:53,160 --> 00:00:54,570
By securing the cryptographic keys

22
00:00:54,570 --> 00:00:57,390
inside the isolated hardware, we add an additional layer

23
00:00:57,390 --> 00:01:00,030
of security against software-based attacks.

24
00:01:00,030 --> 00:01:01,890
Second, we have the HSM,

25
00:01:01,890 --> 00:01:04,680
also known as the hardware security module.

26
00:01:04,680 --> 00:01:07,230
Now, if our TPM is like a personal vault,

27
00:01:07,230 --> 00:01:10,170
an HSM is like a high security bank vault.

28
00:01:10,170 --> 00:01:12,510
It is a physical device that safeguards and manages

29
00:01:12,510 --> 00:01:14,400
digital keys, and is primarily used

30
00:01:14,400 --> 00:01:17,640
for mission critical situations like financial transactions.

31
00:01:17,640 --> 00:01:19,530
A hardware security module will perform

32
00:01:19,530 --> 00:01:22,140
encryption operations within a tamper-proof environment,

33
00:01:22,140 --> 00:01:23,310
and this makes it a reliable

34
00:01:23,310 --> 00:01:25,650
choice for sensitive operations.

35
00:01:25,650 --> 00:01:27,600
Not only does the hardware security module

36
00:01:27,600 --> 00:01:29,610
securely generate cryptographic keys,

37
00:01:29,610 --> 00:01:32,610
but it also can provide accelerated cryptographic operations

38
00:01:32,610 --> 00:01:35,400
all within a tamper-resistant hardware device.

39
00:01:35,400 --> 00:01:38,160
Companies will often rely on hardware security modules

40
00:01:38,160 --> 00:01:39,900
to meet regulatory compliance standards,

41
00:01:39,900 --> 00:01:42,600
especially when they deal with highly sensitive data.

42
00:01:42,600 --> 00:01:45,120
For example, if an online retailer needed to make sure

43
00:01:45,120 --> 00:01:47,490
that each transaction is encrypted using keys generated

44
00:01:47,490 --> 00:01:50,220
and stored within their HSM, this could ensure

45
00:01:50,220 --> 00:01:52,860
that even if the retailer system or databases were breached,

46
00:01:52,860 --> 00:01:55,290
the financial details about each transaction

47
00:01:55,290 --> 00:01:58,410
would remain safely encrypted due to the individual keys

48
00:01:58,410 --> 00:02:00,720
that are used by that hardware security module

49
00:02:00,720 --> 00:02:02,700
when encrypting that data that we're protecting,

50
00:02:02,700 --> 00:02:05,100
using the system's encryption processes.

51
00:02:05,100 --> 00:02:07,740
Third, we have the key management system.

52
00:02:07,740 --> 00:02:09,930
Now, keys in the world of cryptography

53
00:02:09,930 --> 00:02:12,480
are really the lifeblood of the encryption process.

54
00:02:12,480 --> 00:02:14,160
And there are numerous keys that are going to be in play

55
00:02:14,160 --> 00:02:16,470
at any given time, and so it becomes imperative

56
00:02:16,470 --> 00:02:19,440
to have a system that manages, stores, distributes.

57
00:02:19,440 --> 00:02:23,520
And, when the time comes, retires or deletes these keys.

58
00:02:23,520 --> 00:02:26,400
This is where the key management system comes into play.

59
00:02:26,400 --> 00:02:29,340
A key management system, also known as a KMS,

60
00:02:29,340 --> 00:02:31,290
is an integrated approach for generating,

61
00:02:31,290 --> 00:02:33,780
distributing, and managing cryptographic keys

62
00:02:33,780 --> 00:02:35,790
for devices and applications.

63
00:02:35,790 --> 00:02:38,340
The key management system is a centralized mechanism

64
00:02:38,340 --> 00:02:39,900
that controls the entire lifecycle

65
00:02:39,900 --> 00:02:43,050
of these cryptographic keys, from inception or creation

66
00:02:43,050 --> 00:02:45,510
to their eventual retirement and destruction.

67
00:02:45,510 --> 00:02:47,370
With the ever-growing cybersecurity challenges

68
00:02:47,370 --> 00:02:50,130
that are out there, having a robust key management system

69
00:02:50,130 --> 00:02:51,450
is really essential to preventing

70
00:02:51,450 --> 00:02:53,550
unauthorized access to your data.

71
00:02:53,550 --> 00:02:56,250
For example, if you're working for a digital media company

72
00:02:56,250 --> 00:02:58,770
with a requirement for a vast amount of cloud storage

73
00:02:58,770 --> 00:03:01,110
that needs to store all of your multimedia content,

74
00:03:01,110 --> 00:03:03,840
project files, contracts, and more, you want to ensure

75
00:03:03,840 --> 00:03:06,690
that each of those files is encrypted for security.

76
00:03:06,690 --> 00:03:08,580
Now, managing the unique encryption keys

77
00:03:08,580 --> 00:03:10,470
for each of these countless files manually

78
00:03:10,470 --> 00:03:12,480
would be a Herculean task,

79
00:03:12,480 --> 00:03:14,280
but with the key management system,

80
00:03:14,280 --> 00:03:17,070
you can ensure the system automatically manages those keys

81
00:03:17,070 --> 00:03:19,710
and refreshes them periodically to enhance security.

82
00:03:19,710 --> 00:03:22,290
And to ensure that older keys are safely retired

83
00:03:22,290 --> 00:03:23,640
when new ones are being created

84
00:03:23,640 --> 00:03:25,590
and introduced into your system.

85
00:03:25,590 --> 00:03:28,860
Fourth and finally, we need to cover secure enclaves.

86
00:03:28,860 --> 00:03:31,740
Now, the secure enclave is a co-processor that's integrated

87
00:03:31,740 --> 00:03:34,620
into the main processor of some devices, and it's designed

88
00:03:34,620 --> 00:03:37,410
with the sole purpose of ensuring data protection.

89
00:03:37,410 --> 00:03:39,630
Its architecture is such that it's isolated

90
00:03:39,630 --> 00:03:42,240
from the main processor and provides a shielded location

91
00:03:42,240 --> 00:03:45,450
for safe processing and storage of your sensitive data.

92
00:03:45,450 --> 00:03:47,070
I like to think about it like a fortress

93
00:03:47,070 --> 00:03:49,020
inside of your device, and it safeguards

94
00:03:49,020 --> 00:03:51,030
sensitive information like your fingerprints,

95
00:03:51,030 --> 00:03:54,180
facial recognition data, and Apple Pay info.

96
00:03:54,180 --> 00:03:56,700
By keeping this data separate from the main processor,

97
00:03:56,700 --> 00:03:58,440
even if the device gets compromised,

98
00:03:58,440 --> 00:04:01,620
the data within the secure enclave remains untouched.

99
00:04:01,620 --> 00:04:04,500
For example, most people are familiar with Apple's iPhone

100
00:04:04,500 --> 00:04:06,000
and its features like Face ID,

101
00:04:06,000 --> 00:04:08,490
or the older version Touch ID.

102
00:04:08,490 --> 00:04:10,290
Behind the scenes of these two features though

103
00:04:10,290 --> 00:04:12,450
was the secure enclave in action.

104
00:04:12,450 --> 00:04:14,700
When the user sets up a facial ID scan,

105
00:04:14,700 --> 00:04:17,160
the facial recognition data is going to be stored inside

106
00:04:17,160 --> 00:04:19,860
the secure enclave and it will never leave the device.

107
00:04:19,860 --> 00:04:22,530
So even if somebody gains access to the phone, the data

108
00:04:22,530 --> 00:04:25,530
within the isolated environment will remain untouched.

109
00:04:25,530 --> 00:04:28,500
This guarantees that only after a successful biometric match

110
00:04:28,500 --> 00:04:30,390
within the secure enclave happens

111
00:04:30,390 --> 00:04:31,890
that your device will be unlocked,

112
00:04:31,890 --> 00:04:33,390
and this makes it nearly impossible

113
00:04:33,390 --> 00:04:36,570
for unauthorized access to occur on those devices.

114
00:04:36,570 --> 00:04:39,030
So remember, understanding these encryption tools

115
00:04:39,030 --> 00:04:42,090
and how they work is pivotal in today's digital age.

116
00:04:42,090 --> 00:04:44,700
As cybersecurity threats evolve and grow in complexity,

117
00:04:44,700 --> 00:04:46,380
the importance of robust and efficient

118
00:04:46,380 --> 00:04:49,260
encryption mechanisms cannot be overstated.

119
00:04:49,260 --> 00:04:51,450
First, we have the trusted platform module,

120
00:04:51,450 --> 00:04:52,977
which we commonly call the TPM,

121
00:04:52,977 --> 00:04:56,010
and this is a dedicated microcontroller designed to secure

122
00:04:56,010 --> 00:04:58,350
hardware through integrated cryptographic keys,

123
00:04:58,350 --> 00:05:00,390
and offers hardware level security to ensure

124
00:05:00,390 --> 00:05:03,450
the digital secrets remain confidential and unaltered.

125
00:05:03,450 --> 00:05:05,790
A hardware security module, or HSM,

126
00:05:05,790 --> 00:05:08,310
is a physical computing device that safeguards and manages

127
00:05:08,310 --> 00:05:10,290
digital keys for storing authentication,

128
00:05:10,290 --> 00:05:11,850
that performs encryption operations

129
00:05:11,850 --> 00:05:13,890
within a tamper-proof environment.

130
00:05:13,890 --> 00:05:16,770
A key management system, or KMS, is an integrated

131
00:05:16,770 --> 00:05:19,110
and centralized approach to generating, distributing,

132
00:05:19,110 --> 00:05:21,690
and managing cryptographic keys for your devices

133
00:05:21,690 --> 00:05:23,910
and applications across the entire lifecycle

134
00:05:23,910 --> 00:05:27,510
of these cryptographic keys, from creation to destruction.

135
00:05:27,510 --> 00:05:30,720
And the secure enclave is a co-processor that's integrated

136
00:05:30,720 --> 00:05:33,060
into the main processor of some devices,

137
00:05:33,060 --> 00:05:34,440
and it's designed with the sole purpose

138
00:05:34,440 --> 00:05:37,440
of ensuring data protection that isolates the co-processor

139
00:05:37,440 --> 00:05:40,170
from the main processor, to provide a shielded location

140
00:05:40,170 --> 00:05:42,990
for the safe processing and storage of sensitive data.

141
00:05:42,990 --> 00:05:45,480
Also, as the technology continues to advance,

142
00:05:45,480 --> 00:05:47,670
it is really important that you keep yourself up to date

143
00:05:47,670 --> 00:05:49,230
on the latest tools and techniques

144
00:05:49,230 --> 00:05:51,603
to best protect your systems and networks.