4.1.1. Encryption: Data at Rest and in Transit
💡 First Principle: Encryption transforms readable data into unreadable ciphertext using a mathematical key. Only parties with the correct key can read the data. Encryption protects data when the physical or network protection fails—if an encrypted drive is stolen, the data remains protected without the key.
Data at Rest
Data at rest is stored data—on drives, tapes, USB sticks, or cloud storage. Encryption at rest protects against physical theft, unauthorized access to storage media, and insider threats with physical access.
Methods:
- Full disk encryption (FDE): Encrypts the entire drive. The drive is unreadable without the decryption key at boot. Examples: BitLocker (Windows), dm-crypt/LUKS (Linux), self-encrypting drives (SED).
- File/folder encryption: Encrypts specific files or directories. Windows EFS (Encrypting File System) is an example.
- Database encryption: Encrypts specific fields or the entire database. Protects sensitive columns (SSNs, credit card numbers) even from DBAs.
Data in Transit
Data in transit is data moving across a network. Without encryption, any party between sender and receiver can read it.
| Protocol | Protects | Use Case |
|---|---|---|
| TLS (Transport Layer Security) | Application data over TCP | HTTPS, SMTP/TLS, FTPS |
| SSL | Deprecated predecessor to TLS | Legacy only; should not be used |
| IPsec | IP packets at network layer | VPNs, site-to-site encryption |
| SSH | Shell sessions, file transfer (SCP/SFTP) | Remote admin, secure file transfer |
BIOS/UEFI and Bootloader Passwords
- BIOS/UEFI password: Prevents unauthorized access to firmware settings. An attacker with physical access who changes boot order can boot from external media and bypass OS security.
- Bootloader password: Protects the boot process itself. Prevents booting into single-user mode (Linux) or recovery console (Windows) without authentication.
These are layered controls: disk encryption + BIOS password + bootloader password creates multiple barriers for physical attackers.
⚠️ Exam Trap: Encrypting data at rest does not protect against a logged-in authorized user accessing it. Encryption protects against unauthorized physical or storage-level access, not against application-level or authenticated access. Access controls are a separate, complementary protection.
Reflection Question: An employee's laptop is stolen from their car. The laptop has a login password but no disk encryption. What data is at risk, and why doesn't the login password protect it?
