Encryption in Practice: What, With What, When

Encryption is the control most people believe solves something on its own. In practice it defends against very specific threats and not at all against others, and without knowing which, money goes to the wrong place.

Three states

Data at rest. Data sitting on disk, in backups or object storage. Disk encryption covers the threat of physical media falling into the wrong hands: a stolen laptop, a decommissioned drive, a lost backup tape.

Data in transit. Data moving over the network. TLS protects against interception and man-in-the-middle.

Data in use. Data in memory, under processing. The hardest area, and unaddressed in most environments.

What encryption does not solve

This is the more important part, because it is where false confidence arises.

Disk encryption does not protect a running system. If the machine is powered on and the user signed in, data is readable. Malware or an attacker running on the system sees it just as the user does.

Database encryption does not protect through the application. If the attacker queries via SQL injection, the database happily returns decrypted data, because the query appears authorised.

TLS does not protect the endpoints. Encryption protects between two endpoints. If either endpoint is compromised, encryption is irrelevant.

Encryption is not access control. Whoever has legitimate access gets decrypted data. Encryption does not replace the privilege model.

Where it is worth deploying

Workstations and mobile devices. Full disk encryption without exception. The cheapest measure, covering precisely the most common threat: the lost or stolen device.

Backups. Particularly those stored off site. An unencrypted backup carries the same risk as the production system, with fewer people watching.

Databases. Storage-level encryption protects against disk theft. Application-level encryption of sensitive fields goes further, because even the database administrator cannot read it.

Every network connection. Not only external: communication between internal services too. An attacker already inside listens just the same.

Cloud storage. Provider encryption is the baseline, but for sensitive data customer-managed keys are worthwhile so the provider cannot read it either.

Key management: where most fail

Encryption is worth exactly as much as its key management. Typical mistakes:

The key sits beside the data. On the same server, in the same backup. Whoever reaches the data reaches the key.

Nobody rotates keys. Without rotation, a compromised key works forever.

No recovery plan. A lost key means lost data. Storing the recovery key matters as much as the protection itself.

Keys in source code. Then every developer and every commit history contains them.

In high-value environments an HSM or a cloud key management service is the answer: the key never leaves the device, only the operation's result comes out.

Worth checking too

Algorithms. Today AES-256 for data at rest, TLS 1.3 in transit. Older versions (SSL, TLS 1.0 and 1.1) should be disabled.

Certificate expiry. An expired certificate causes outage. Automatic renewal and expiry alerting are needed.

Long-retention data. For anything kept ten years it is worth thinking about post-quantum algorithms today, because data stolen now may be decrypted later.

Our data protection service covers designing the encryption architecture and key management.