In this lesson,
we're going to discuss data encryption levels.
Data encryption is the process
of converting data into a secret code
to prevent unauthorized access.
By doing so, data encryption ensures the confidentiality,
integrity and security of the information,
even if the storage medium
or communication channel is being compromised.
Now, when it comes to data encryption,
data can be encrypted at different levels,
including full-disk encryption, partition,
file, volume, database or record-level encryption.
Now, first we have full-disk encryption.
Full-disk encryption, as its name suggests,
encrypts the entire hard disk drive or storage device
to protect all the data being stored on it.
For example, on a Windows-based system,
you can use the software full-disk encryption tool
known as BitLocker, to encrypt the entire contents
of your hard disk drive or solid state device.
When you boot up your system,
BitLocker will require the use of a pin,
a password, or a security key
to ensure that even if your storage device is removed
and accessed from another system,
your data will remain securely encrypted
and safe from prying eyes.
If you're using a macOS system, on the other hand,
you can use FileVault for this same purpose.
Alternatively, some storage devices
will also have hardware level full-disk encryption
embedded into them as well.
Second, we have partition encryption.
Now, partition encryption is similar
to full-disk encryption, but it's only going to be applied
to a specific partition on your storage device.
For example, if you use a software tool like VeraCrypt,
you can choose to encrypt
only the partition containing sensitive documents
while leaving all of your other partitions,
like the operating system partition,
as an unencrypted partition.
Now, you may wonder why we wouldn't just encrypt
the entire drive instead of only encrypting a partition.
And the reason here is that encryption does add
some extra overhead to the process of reading
or writing data to a storage device,
because now we have to decrypt the data being read
or encrypt the data being written.
So a lot of times we will choose just to encrypt
the portions that contain sensitive data,
because this will speed up our overall system.
Now, third, we have volume encryption.
Volume encryption is a technique that's used
to encrypt the set space on the storage media
to create an encrypted container
that can house various files and folders.
Now, VeraCrypt is a common tool
for creating these kinds of encrypted volumes
and this method provides us with flexibility,
because we can decide the size of the encrypted volume
that we want to use.
This allows us to have this
as a secondary form of encryption
that can be used in addition
to a full-disk encryption system.
This way, we can allow the entire disk to be encrypted
using full-disk encryption
and then use a secondary partition
that might contain some more sensitive data
that's also going to be created and encrypted
using a volume encryption tool like VeraCrypt.
Fourth, we have file-level encryption.
File-level encryption is used to encrypt an individual file
instead of an entire partition or an entire disk drive.
Now, for example, let's say you're using
a software tool like GNU's Privacy Guard, also known as GPG.
You can do this to encrypt
just the specified files you want
and now you can send those files back and forth
to your coworkers over email
and not worry about any attacker being able to read them,
because these files are fully encrypted.
Now, this method is really useful if you only need to secure
a few crucial files rather than your entire disk,
or you want to be able to encrypt a file
before you send it off of your system to some other person.
Fifth, we have database encryption.
With database encryption, your entire database
is going to be encrypted,
and this is similar to conducting a full-disk encryption,
but this actually can span several storage devices
or a cloud-based storage environment too,
because our databases are often stored
across multiple data sets.
For example, you might have data encryption
using the SQL Server Transparent Data Encryption, or TDE.
Now, this type of database encryption
will automatically encrypt the entire database
and it requires no changes to your underlying application,
because all the access to the data
is happening by the database system
who's taking care of the encryption
and decryption tasks on your behalf.
Sixth, we have record-level encryption.
Now, record-level encryption
is used to encrypt individual records
or rows within a database.
This is a more granular method and it provides flexibility
to encrypt only specific data within a database.
For example, inside of your customer database,
you may only encrypt the columns
containing sensitive information,
like their credit card number
or their social security number inside of the database,
instead of having to encrypt the entire database.
So remember, data encryption can be applied
at various levels, including full-disk,
partition, file, volume,
database and record-level encryption.
Each of these provides a different layer
in granularity of security,
so it's important to understand the differences
to ensure that you can select the right balance
between security and system performance
when you determine which encryption type
you want to utilize in your organization.
Data encryption does require thoughtful planning,
implementation and ongoing oversight.
Our objective here is to ensure
that your data remains secure
and inaccessible to unauthorized entities
regardless of where that data
is actually going to be stored.