Defense
№ 030 · class: resilience
Data Encryption
Protecting data by encrypting it at rest and in transit.
Term
description · examples · notesProtecting data by encrypting it at rest and in transit.
Description
At rest: AES-256 for disks, databases, and backups.
In transit: TLS 1.3 for web, email, and API communication.
End-to-end encryption ensures that even intermediaries cannot read content.
Key management (KMS) is as important as the algorithm itself.
What people often say
- Encryption does not protect from insiders with legitimate access to decrypted data.
- HTTPS does not guarantee a site is safe — only that communication is encrypted.
Covers / does not cover
Covers
- Disk and file encryption
- TLS for network communication
- Key management (KMS)
Does not cover
- Protection from malware on a decrypted system
- User authentication (that is IAM/MFA)
- Data integrity without additional controls (HMAC)
Mentioned in the news
Threats
reduces 6Threats it reduces. Select one to open its page.
Techniques
neutralizes 4Techniques it neutralizes. Select one to open its page.