A basic understanding of data encryption and its application is helpful if you own or manage a business.
Data is likely the lifeblood of your organization. Protecting your and your customers’ sensitive data from unauthorized access is essential.
This is where data encryption comes in — it is now a core pillar of data security management.
In this blog post, we’ll explore the origins of encryption, examine its different types, and explain why it’s essential for businesses of all sizes.
From Ancient Ciphers to Modern Algorithms
The concept of transforming data to make it unreadable isn’t new. Ancient civilizations used ciphers to keep messages secret.
The Caesar cipher is a classic example. It was a rudimentary form of encryption used by Julius Caesar that involved shifting letters of the alphabet by three places.
Fast-forward to today, sophisticated algorithms like AES (Advanced Encryption Standard) form the backbone of digital security. The need to keep sensitive data secure and messages private has driven cryptography’s evolution.
In the United States, AES was announced by the National Institute of Standards and Technology (NIST) as U.S. Federal Information Processing Standards Publication 197 (FIPS 197) on November 26, 2001.
NIST accepted the Rijndael block cipher AES proposal, which specified a block size of 128 bits and three different key lengths: 128, 192, and 256 bits.
A 256-bit key has 2 to the power of 256 (2256) possibilities — a number with 78 numeric characters. Expressed in ‘illioins,’ it’s 115.792 quattuorvigintillion combinations.
You’d think this would be unhackable — it is today but may not be in five to ten years. More on this is below.
Beyond data secrecy, encryption evolved to address challenges like non-repudiation, which ensures the sender of a message can’t deny sending it, and anti-tampering, which prevents the modification of messages in transit.
These functionalities paved the way for e-commerce and secure digital transactions, demonstrating that encryption’s role extends beyond simple secrecy.
Symmetric vs. Asymmetric Encryption
When discussing encryption, two terms often come up: symmetric and asymmetric encryption.
Asymmetric encryption uses two keys: a public key and a private key. Think of a physical post office box. You can send messages to the mailbox using its public address, but only the mailbox owner with the key can open it.
In the digital world, when you connect to Amazon’s website, your browser receives Amazon’s public key.
You can then use this public key to encrypt any messages you send. Only the recipient (in this example, Amazon) can decrypt these messages with its private key. This process makes it safe to send sensitive information across the internet.
Asymmetric encryption is mainly used for consumer-to-business and inter-business communications.
Symmetric encryption uses a single key for encryption and decryption and is often used for intra-business file encryption.
Imagine sharing an encryption/decryption key with a friend—you use it to encode your messages, and your friend uses it to decode them.
This method is efficient, but it faces a challenge. How do you securely share that key? Sending it through the same channels as the messages risks interception.
Actifile’s co-founders discuss data encryption
Encryption and the CIA Model
Data encryption is a cornerstone of the CIA (Confidentiality, Integrity, and Availability) data model. Its roles include:
- Confidentiality: Encryption protects data from unauthorized access in transit (such as emails or website interactions) and at rest (such as the files on a hard drive).
- Integrity: Encryption with hash functions ensures data hasn’t been tampered with. If a message’s hash changes, you know something’s been altered.
- Availability: While encryption isn’t primarily about availability, it can support business continuity by protecting backed-up data.
To sum up, encryption safeguards confidentiality, ensures integrity, and supports availability.
Full Disk vs. File Level Encryption
Two approaches to managing data encryption within businesses are full disk and file-level encryption.
Full disk encryption involves end users or IT administrators controlling policies and individual machine encryption keys.
Microsoft Windows BitLocker is an example of this type of encryption. It is a Windows-specific app that protects a stolen laptop or a hard drive that is disposed of or traded in before it is completely wiped.
Trade secrets and classified government data can be stored on an encrypted drive that is physically archived.
BitLocker only encrypts a disk’s contents until Windows boots up. Once Windows is running, all files are unencrypted. Sensitive data is at risk if a successful phishing attempt occurs.
BitLocker does not protect data in transit within a network. For example, if one BitLocker user emails a spreadsheet containing PII to another user, the spreadsheet file attachment is not encrypted.
File-level encryption is centrally controlled by an IT administrator or an MSP’s team.
A single key is used across an organization, encrypting specific data files within a ‘virtual boundary.’
This simplifies management and effectively protects specific sensitive data at rest and in transit (sensitive data is identified through an automated discovery process).
File-level encryption software is not Windows-specific; it can encrypt data on MacOS, Linux devices, and cloud drives.
Compliance & Data Protection Standards
Compliance with regulations like GDPR, HIPAA, and CCPA has become essential for many businesses today. Non-compulsory industry standards include ISO 27001, CIS Critical Security Controls, and CMMC.
Encryption is typically required to ensure compliance with data protection regulations and standards.
By encrypting sensitive data, companies can significantly reduce the risk of penalties and reputational damage in case of a data breach. Compromised encrypted data may not trigger mandatory breach disclosure if encrypted using a NIST-recommended standard.
Hybrid Environments
Today, most companies operate in a hybrid environment, using a mix of on-premise endpoints, servers, and cloud file repositories.
Regardless of where your data lives, you must assess the risks, and in most cases, you should encrypt sensitive data. Encryption reduces the magnitude of losses and increases resilience after cyber attacks.
Risk is a combination of an event’s potential and the magnitude of financial losses, not just the potential itself. The cloud should be treated like any other environment that needs protection.
The Future of Encryption: Preparing for Post-Quantum Computing
Emerging threats, such as quantum computing, are causing concern in the cryptography community. At some point, quantum computers will likely break current encryption standards.
To prepare, organizations must stay updated on ongoing developments, specifically the post-quantum cryptography standards being assembled by NIST. They should also plan to migrate to post-quantum algorithms over the next ten years.
