1
00:00:00,000 --> 00:00:00,990
In this lesson,

2
00:00:00,990 --> 00:00:03,660
we're going to discuss data encryption levels.

3
00:00:03,660 --> 00:00:05,070
Data encryption is the process

4
00:00:05,070 --> 00:00:07,170
of converting data into a secret code

5
00:00:07,170 --> 00:00:09,240
to prevent unauthorized access.

6
00:00:09,240 --> 00:00:12,120
By doing so, data encryption ensures the confidentiality,

7
00:00:12,120 --> 00:00:14,640
integrity and security of the information,

8
00:00:14,640 --> 00:00:15,750
even if the storage medium

9
00:00:15,750 --> 00:00:18,360
or communication channel is being compromised.

10
00:00:18,360 --> 00:00:20,130
Now, when it comes to data encryption,

11
00:00:20,130 --> 00:00:22,080
data can be encrypted at different levels,

12
00:00:22,080 --> 00:00:24,480
including full-disk encryption, partition,

13
00:00:24,480 --> 00:00:28,590
file, volume, database or record-level encryption.

14
00:00:28,590 --> 00:00:30,750
Now, first we have full-disk encryption.

15
00:00:30,750 --> 00:00:32,940
Full-disk encryption, as its name suggests,

16
00:00:32,940 --> 00:00:35,760
encrypts the entire hard disk drive or storage device

17
00:00:35,760 --> 00:00:38,100
to protect all the data being stored on it.

18
00:00:38,100 --> 00:00:40,170
For example, on a Windows-based system,

19
00:00:40,170 --> 00:00:42,110
you can use the software full-disk encryption tool

20
00:00:42,110 --> 00:00:44,880
known as BitLocker, to encrypt the entire contents

21
00:00:44,880 --> 00:00:47,490
of your hard disk drive or solid state device.

22
00:00:47,490 --> 00:00:48,900
When you boot up your system,

23
00:00:48,900 --> 00:00:50,354
BitLocker will require the use of a pin,

24
00:00:50,354 --> 00:00:52,470
a password, or a security key

25
00:00:52,470 --> 00:00:54,540
to ensure that even if your storage device is removed

26
00:00:54,540 --> 00:00:56,220
and accessed from another system,

27
00:00:56,220 --> 00:00:58,260
your data will remain securely encrypted

28
00:00:58,260 --> 00:01:00,060
and safe from prying eyes.

29
00:01:00,060 --> 00:01:02,430
If you're using a macOS system, on the other hand,

30
00:01:02,430 --> 00:01:05,099
you can use FileVault for this same purpose.

31
00:01:05,099 --> 00:01:06,960
Alternatively, some storage devices

32
00:01:06,960 --> 00:01:09,090
will also have hardware level full-disk encryption

33
00:01:09,090 --> 00:01:11,010
embedded into them as well.

34
00:01:11,010 --> 00:01:13,320
Second, we have partition encryption.

35
00:01:13,320 --> 00:01:14,790
Now, partition encryption is similar

36
00:01:14,790 --> 00:01:17,430
to full-disk encryption, but it's only going to be applied

37
00:01:17,430 --> 00:01:20,160
to a specific partition on your storage device.

38
00:01:20,160 --> 00:01:22,920
For example, if you use a software tool like VeraCrypt,

39
00:01:22,920 --> 00:01:23,850
you can choose to encrypt

40
00:01:23,850 --> 00:01:26,280
only the partition containing sensitive documents

41
00:01:26,280 --> 00:01:27,750
while leaving all of your other partitions,

42
00:01:27,750 --> 00:01:29,430
like the operating system partition,

43
00:01:29,430 --> 00:01:31,380
as an unencrypted partition.

44
00:01:31,380 --> 00:01:33,450
Now, you may wonder why we wouldn't just encrypt

45
00:01:33,450 --> 00:01:36,300
the entire drive instead of only encrypting a partition.

46
00:01:36,300 --> 00:01:38,430
And the reason here is that encryption does add

47
00:01:38,430 --> 00:01:39,998
some extra overhead to the process of reading

48
00:01:39,998 --> 00:01:42,420
or writing data to a storage device,

49
00:01:42,420 --> 00:01:44,670
because now we have to decrypt the data being read

50
00:01:44,670 --> 00:01:46,200
or encrypt the data being written.

51
00:01:46,200 --> 00:01:48,870
So a lot of times we will choose just to encrypt

52
00:01:48,870 --> 00:01:50,850
the portions that contain sensitive data,

53
00:01:50,850 --> 00:01:53,310
because this will speed up our overall system.

54
00:01:53,310 --> 00:01:55,650
Now, third, we have volume encryption.

55
00:01:55,650 --> 00:01:57,570
Volume encryption is a technique that's used

56
00:01:57,570 --> 00:01:59,880
to encrypt the set space on the storage media

57
00:01:59,880 --> 00:02:01,380
to create an encrypted container

58
00:02:01,380 --> 00:02:03,480
that can house various files and folders.

59
00:02:03,480 --> 00:02:04,690
Now, VeraCrypt is a common tool

60
00:02:04,690 --> 00:02:07,230
for creating these kinds of encrypted volumes

61
00:02:07,230 --> 00:02:09,419
and this method provides us with flexibility,

62
00:02:09,419 --> 00:02:11,610
because we can decide the size of the encrypted volume

63
00:02:11,610 --> 00:02:12,840
that we want to use.

64
00:02:12,840 --> 00:02:13,890
This allows us to have this

65
00:02:13,890 --> 00:02:15,540
as a secondary form of encryption

66
00:02:15,540 --> 00:02:16,530
that can be used in addition

67
00:02:16,530 --> 00:02:18,600
to a full-disk encryption system.

68
00:02:18,600 --> 00:02:21,060
This way, we can allow the entire disk to be encrypted

69
00:02:21,060 --> 00:02:22,500
using full-disk encryption

70
00:02:22,500 --> 00:02:24,210
and then use a secondary partition

71
00:02:24,210 --> 00:02:26,160
that might contain some more sensitive data

72
00:02:26,160 --> 00:02:27,870
that's also going to be created and encrypted

73
00:02:27,870 --> 00:02:30,720
using a volume encryption tool like VeraCrypt.

74
00:02:30,720 --> 00:02:32,910
Fourth, we have file-level encryption.

75
00:02:32,910 --> 00:02:36,000
File-level encryption is used to encrypt an individual file

76
00:02:36,000 --> 00:02:39,540
instead of an entire partition or an entire disk drive.

77
00:02:39,540 --> 00:02:41,130
Now, for example, let's say you're using

78
00:02:41,130 --> 00:02:45,570
a software tool like GNU's Privacy Guard, also known as GPG.

79
00:02:45,570 --> 00:02:46,680
You can do this to encrypt

80
00:02:46,680 --> 00:02:48,540
just the specified files you want

81
00:02:48,540 --> 00:02:51,000
and now you can send those files back and forth

82
00:02:51,000 --> 00:02:52,500
to your coworkers over email

83
00:02:52,500 --> 00:02:54,630
and not worry about any attacker being able to read them,

84
00:02:54,630 --> 00:02:57,150
because these files are fully encrypted.

85
00:02:57,150 --> 00:02:59,910
Now, this method is really useful if you only need to secure

86
00:02:59,910 --> 00:03:02,880
a few crucial files rather than your entire disk,

87
00:03:02,880 --> 00:03:04,470
or you want to be able to encrypt a file

88
00:03:04,470 --> 00:03:07,650
before you send it off of your system to some other person.

89
00:03:07,650 --> 00:03:09,660
Fifth, we have database encryption.

90
00:03:09,660 --> 00:03:11,910
With database encryption, your entire database

91
00:03:11,910 --> 00:03:13,080
is going to be encrypted,

92
00:03:13,080 --> 00:03:15,690
and this is similar to conducting a full-disk encryption,

93
00:03:15,690 --> 00:03:18,270
but this actually can span several storage devices

94
00:03:18,270 --> 00:03:20,250
or a cloud-based storage environment too,

95
00:03:20,250 --> 00:03:21,960
because our databases are often stored

96
00:03:21,960 --> 00:03:23,850
across multiple data sets.

97
00:03:23,850 --> 00:03:25,980
For example, you might have data encryption

98
00:03:25,980 --> 00:03:30,360
using the SQL Server Transparent Data Encryption, or TDE.

99
00:03:30,360 --> 00:03:31,491
Now, this type of database encryption

100
00:03:31,491 --> 00:03:33,870
will automatically encrypt the entire database

101
00:03:33,870 --> 00:03:36,600
and it requires no changes to your underlying application,

102
00:03:36,600 --> 00:03:38,340
because all the access to the data

103
00:03:38,340 --> 00:03:40,320
is happening by the database system

104
00:03:40,320 --> 00:03:41,640
who's taking care of the encryption

105
00:03:41,640 --> 00:03:44,040
and decryption tasks on your behalf.

106
00:03:44,040 --> 00:03:46,320
Sixth, we have record-level encryption.

107
00:03:46,320 --> 00:03:47,580
Now, record-level encryption

108
00:03:47,580 --> 00:03:49,260
is used to encrypt individual records

109
00:03:49,260 --> 00:03:50,880
or rows within a database.

110
00:03:50,880 --> 00:03:53,550
This is a more granular method and it provides flexibility

111
00:03:53,550 --> 00:03:56,520
to encrypt only specific data within a database.

112
00:03:56,520 --> 00:03:58,980
For example, inside of your customer database,

113
00:03:58,980 --> 00:04:00,270
you may only encrypt the columns

114
00:04:00,270 --> 00:04:01,770
containing sensitive information,

115
00:04:01,770 --> 00:04:02,940
like their credit card number

116
00:04:02,940 --> 00:04:05,590
or their social security number inside of the database,

117
00:04:05,590 --> 00:04:08,130
instead of having to encrypt the entire database.

118
00:04:08,130 --> 00:04:10,200
So remember, data encryption can be applied

119
00:04:10,200 --> 00:04:12,210
at various levels, including full-disk,

120
00:04:12,210 --> 00:04:14,340
partition, file, volume,

121
00:04:14,340 --> 00:04:16,560
database and record-level encryption.

122
00:04:16,560 --> 00:04:17,970
Each of these provides a different layer

123
00:04:17,970 --> 00:04:19,410
in granularity of security,

124
00:04:19,410 --> 00:04:21,329
so it's important to understand the differences

125
00:04:21,329 --> 00:04:22,860
to ensure that you can select the right balance

126
00:04:22,860 --> 00:04:24,900
between security and system performance

127
00:04:24,900 --> 00:04:26,550
when you determine which encryption type

128
00:04:26,550 --> 00:04:28,980
you want to utilize in your organization.

129
00:04:28,980 --> 00:04:31,470
Data encryption does require thoughtful planning,

130
00:04:31,470 --> 00:04:33,750
implementation and ongoing oversight.

131
00:04:33,750 --> 00:04:35,250
Our objective here is to ensure

132
00:04:35,250 --> 00:04:36,450
that your data remains secure

133
00:04:36,450 --> 00:04:38,640
and inaccessible to unauthorized entities

134
00:04:38,640 --> 00:04:39,870
regardless of where that data

135
00:04:39,870 --> 00:04:41,420
is actually going to be stored.