Encrypting Data - CompTIA Security+ SY0-701 - 1.4

Data Protection: Understanding Encryption

Importance of Encrypting Stored Data

• To protect data on storage devices like SSDs and hard drives, it is essential to encrypt stored data, often referred to as "data at rest."

• Full disk or volume-level encryption can be utilized, with BitLocker for Windows and FileVault for Mac OS being common tools.

File-Level Encryption Techniques

• In Windows, the Encrypting File System (EFS) allows file-level encryption within NTFS. Other operating systems offer third-party utilities for similar functions.

• Users can enable EFS by accessing file properties and selecting "Encrypt contents to secure data" in Advanced Attributes.

Database Encryption Strategies

• Databases may employ transparent encryption using symmetric keys to protect sensitive information while allowing some non-sensitive data to remain in plain text.

• An example includes an employee database where sensitive fields like Social Security numbers can be encrypted while other fields remain accessible without decryption.

Column-Level vs. Full Database Encryption

• Column-level encryption allows specific sensitive data (e.g., Social Security numbers) to be encrypted while keeping other columns in plain text for efficient searching.

• Accessing encrypted information requires decrypting either the entire column or a specific record, which can introduce overhead.

Network Data Protection Methods

• When transmitting data over networks, protocols like HTTPS ensure that communications are encrypted, protecting against eavesdropping.

• Virtual Private Networks (VPNs), such as those using SSL/TLS or IPsec, create secure tunnels for sending information between devices.

Agreement on Encryption Algorithms

• Successful encryption requires both parties to agree on the same algorithms; this ensures compatibility during decryption processes.

• Users typically do not see algorithm details but rely on applications that implement these algorithms correctly.

Comparing Encryption Standards

• Different encryption algorithms have varying security levels and performance characteristics; understanding these differences is crucial for effective implementation.

Encryption Algorithms Overview

DES and AES Encryption Methods

• The DES encryption algorithm consists of five steps, which involve splitting data into left and right plaintext to produce a 64-bit ciphertext.

• AES operates differently by combining plaintext with a secret key to generate ciphertext, with various versions available for different output levels.

• It is crucial to use compatible algorithms for both encryption and decryption; DES cannot decrypt AES ciphertext.

Understanding Algorithm Transparency

• Encryption algorithms are typically public, allowing scrutiny of their code and mathematical processes, enhancing trustworthiness.

• Despite knowing how the algorithms function, access to encrypted data requires the correct key, similar to needing a specific key for a door lock.

Importance of Key Security

• Keeping private keys secure is essential; unauthorized access allows attackers to unlock encrypted data.

• Keys are vulnerable to brute force attacks where attackers try every possible permutation; longer keys significantly reduce this risk.

Key Length Considerations

• A common symmetric key length is 128 bits or larger; as technology advances, longer keys may be necessary due to increased processing power.

• Asymmetric encryption also benefits from longer keys (e.g., 3072 bits), necessitating ongoing adjustments in key lengths over time.

Enhancing Key Security Through Key Stretching