Encrypting Data Flashcards

1. At rest — stored on drives, SSDs, USB
2. In database — stored in database tables
3. In transit — moving across a network

Windows full-volume encryption. Encrypts an entire disk so data is unreadable without the decryption key (stored in TPM). Protects data-at-rest against physical drive theft.

Apple macOS full-disk encryption — equivalent to BitLocker. Encrypts the entire volume. Data is inaccessible without login credentials or recovery key.

Encrypting File System — Windows file-level encryption built into NTFS. Encrypts individual files or folders (not the whole volume). Enabled via file Properties → Advanced Attributes → "Encrypt contents to secure data."

Encrypting an entire database with a symmetric key. All data is encrypted — every column and row. Maximum protection but queries must decrypt everything, creating higher overhead.

Encrypting only specific sensitive database columns (SSN, credit card, diagnosis) while leaving non-sensitive columns in plaintext. Better performance — decryption only happens when the sensitive column is accessed.

HTTP over TLS — encrypts all communication between a browser and web server. Shown by the padlock icon. Standard for any website handling sensitive information. Protects data in transit.

IPsec — Internet Protocol Security. Encrypts IP packets at the network layer. Used to create persistent encrypted tunnels between two office networks. Both endpoints must support the same IPsec configuration.

SSL/TLS — used for remote-user VPNs (client VPNs). Allows individual users to connect from anywhere to the corporate network over an encrypted tunnel. More flexible than IPsec for mobile users.

Algorithms define both the encryption process AND the decryption formula. AES-encrypted data CANNOT be decrypted by DES. Both endpoints agree on an algorithm before the session starts — otherwise communication fails.

Publishing the algorithm allows peer review and trust-building — if the math is scrutinized by experts and holds up, it's trustworthy. Security comes from the KEY — even knowing exactly how AES works, you cannot decrypt without the key. Like knowing how a lock works but not having the key.

Hashing a password (or key) multiple times — hash the hash of the hash — to make brute-force attacks more expensive. Each brute-force attempt must perform the same hash chain, multiplying computation time significantly.

128-bit minimum (AES-128). AES-256 is recommended for high-security applications. Key lengths must increase over time as computing power grows. A 56-bit DES key is now brute-forceable — don't use DES.

3072-bit or larger for RSA. Asymmetric keys need to be much longer than symmetric keys because the mathematical structure of the key pair provides additional attack surface. Key lengths grow as processors improve.

When you need to encrypt only specific files on a shared server — not the entire volume. Example: a file server where most content is public, but a few sensitive HR documents need encryption. EFS encrypts those files specifically; other users can still access their non-sensitive files normally.

Data Encryption Standard. No — it should NOT be used. 56-bit key length is too short and has been brute-forced. Replaced by AES. Still appears on the Security+ exam as a "do not use" comparison point. If a question mentions DES as an option, it's almost always the wrong answer.