What Is Encryption?

Encryption is a method of data security that converts data from a readable format into an encoded format that can only be read or processed after it has been decrypted using a cryptographic key. It’s a common process in cryptography that encodes a message or information so that only authorised parties can access it and those who are not authorised cannot.

As an effective security measure, encryption protects sensitive data from being stolen or compromised, and both individual users and large corporations widely use it to protect user information sent between a browser and a server.

Encryption converts human-readable plaintext into incomprehensible text, known as “ciphertext”. Encryption works by encoding plaintext into ciphertext using cryptographic mathematical models known as algorithms. Decoding the data back to plaintext requires using a decryption key, a string of numbers, or a password also created by an algorithm.

As an integral part of data security, encryption protects data from theft, manipulation, or compromise. It works by mixing up data into a secret code that only a unique encryption key can unlock. While encryption is a proven method to secure and protect data, it hinges on carefully managing cryptographic keys to be accessible when needed.

Encryption is essential to cybersecurity and data protection, as it protects private information and sensitive data and enhances the security of communication between client apps and servers. Encryption is critical to every organisation because it protects confidential data by converting it into ciphertext.

As a vital element of data security, encryption makes it nearly impossible for cybercriminals or other unauthorised parties to steal and misuse the data since only those with an encryption key can access the data’s true information. It protects against data interception, data breaches, and various forms of cyber-attacks.

There are two commonly used types of encryption: symmetric and asymmetric encryption.

Symmetric Encryption

Symmetric encryption is a simpler type that uses the same key for both encryption and decryption. This means that the sender and recipient must have access to the same key to decrypt the data. Symmetric encryption is faster and more efficient than asymmetric encryption, making it the preferred method for transmitting data in bulk. Common symmetric encryption methods include Advanced Encryption Standard (AES), Data Encryption Standard (DES), and Triple Data Encryption Standard (3DES).

Asymmetric Encryption

Asymmetric encryption, also known as public-key cryptography, uses two separate keys for the encryption process. One key is the public key used to encrypt the data, while the other is the private key used to decrypt the data. The owner keeps the private key secret, while the public key is either shared among authorised recipients or made available to the public. Data that’s encrypted using the recipient’s public key can only be decrypted with the corresponding private key. Asymmetric encryption is slower and more complex than symmetric encryption, but it is more secure and eliminates the need for a secure key exchange. Common asymmetric encryption methods include RSA and Elliptic Curve Cryptography (ECC).

Hashing is another technique used in encryption, but it is not a form of encryption. Hashing generates a fixed-length value summarising a file or message’s contents. It is used to verify data integrity and detect unauthorised changes to data.

Encryption provides several benefits for individuals and organisations, including:

• Data protection: Encryption helps protect sensitive data from being stolen, read, or altered by unauthorised users. It ensures that only those with the proper decryption key can access the data, making it nearly impossible for cybercriminals to steal or misuse it.
• Compliance: Encryption can help organisations meet regulatory and legal requirements for data protection. Many industries, such as healthcare and finance, must adhere to strict regulations about how consumer data is used and stored, and encryption helps organisations meet those standards and ensure compliance.
• Increased security: Encryption provides an additional layer of security to protect against data breaches, cyber-attacks, and other threats. It makes it harder for cybercriminals to intercept data. It helps protect an organisation’s reputation by ensuring that sensitive data is stored in an encrypted format, making it unreadable unless the proper decryption key is used.
• Maintaining data integrity: Encryption can help preserve data integrity by verifying that it has not been tampered with or altered. Encryption can be used to verify the integrity of backups and to maintain the integrity of data in transit, preventing hackers from intercepting communications and tampering with the data.
• Increased consumer trust: Encryption can boost consumer trust and confidence in an organisation by publicly disclosing the use of encryption technologies. Customers are more likely to stick with the company and recommend it to others, making encryption a vote of confidence and loyalty.

Encryption provides several benefits, but it also has some disadvantages to consider. The disadvantages of encryption include:

• Cost: Encryption can be expensive to implement and maintain, requiring additional resources and upgrades to perform such tasks.
• Key management: Key management is a significant disadvantage of encryption because lost encryption and decryption keys cannot be recovered.
• Compatibility: Encryption technology can be tricky when dealing with different systems and applications. It can be challenging to ensure that all authorised users can read encrypted data, which can limit the visibility and usability of data.
• Unrealistic requirements: If an organisation fails to adopt the encryption best practices, especially the restraints imposed by data encryption technology, it can result in unrealistic requirements that could jeopardise data security.
• Performance impact: Encryption can impact the speed and efficiency of data processing and analysis, especially when dealing with large amounts of data.
• Data retrieval: If the user forgets the encryption key, the data on a computer becomes inaccessible.

Despite these disadvantages, the benefits of encryption outweigh them, making encryption essential to cybersecurity and data protection.

Triple DES Encryption

Triple DES was designed to replace the original Data Encryption Standard (DES) algorithm, which hackers easily defeated. At one time, Triple DES was the recommended standard and the most widely used symmetric algorithm in the industry.

Triple DES uses three individual keys with 56 bits each. The total key length adds up to 168 bits, but experts say 112 bits in key strength is more like it.

Though it is slowly being phased out, Triple DES is still a dependable hardware encryption solution for financial services and other industries.

RSA Encryption

RSA is a public-key encryption algorithm and the standard for encrypting data sent over the internet. It is also one of the methods used in PGP (Pretty Good Privacy) and GPG (GNU Privacy Guard) programmes.

Unlike Triple DES, RSA is considered an asymmetric encryption algorithm because it uses a pair of keys. The public key encrypts a message, and a private key decrypts it. It takes attackers quite a bit of time and processing power to break this encryption code.

Advanced Encryption Standards (AES)

The Advanced Encryption Standard (AES) is the algorithm trusted as the standard by the U.S. government and many other organisations.

Although it is extremely efficient in 128-bit form, AES encryption also uses keys of 192 and 256 bits for heavy-duty encryption.

Blowfish

Blowfish is a symmetric encryption algorithm used to encrypt and decrypt data. It’s known for its high speed and efficiency, and it is often used in software applications that require fast encryption and decryption.

Twofish

A symmetric encryption algorithm similar to Blowfish but considered more secure, Twofish is commonly used in software applications requiring high levels of security, such as financial and healthcare applications.

RC4

Also a symmetric encryption algorithm, RC4 is widely used in software applications that require fast encryption and decryption. However, RC4 is now considered insecure and is no longer recommended.

Encryption plays a vital role in safeguarding information, with several standards and methods employed based on use cases. Here are the following standards for encryption:

• Data Encryption Standard (now obsolete).
• Advanced Encryption Standard.
• RSA (the original public-key algorithm).

File Encryption:

This involves encrypting individual files or directories directly by the file system, often called file and folder encryption.

Disk Encryption:

Every piece of data stored on a disk or volume is encrypted, making it unreadable without the proper decryption key. Software or dedicated hardware can perform disk encryption.

Email Encryption:

Email encryption protects emails from unauthorised eyes. Typically, emails are sent in the clear, making them vulnerable. Encryption methods for emails include Transport Layer Security (TLS) and end-to-end encryption, with popular options being PGP and S/MIME protocols. These methods secure the content and may validate the sender’s and recipient’s authenticity.

1. Know the laws: Organisations must adhere to many overlapping, privacy-related regulations when safeguarding personally identifiable information. The top six regulations that impact many organisations include: FERPA, HIPAA, HITECH, COPPA, PCI DSS, and state-specific data breach notifications laws.
2. Assess the data: A HIPAA Security Rule does not explicitly require encryption but does state that entities should perform a data risk assessment and implement encryption if the assessment indicates that encryption would be a “reasonable and appropriate” safeguard. If an organisation decides not to encrypt electronic protected health information (ePHI), the institution must document and justify that decision and then implement an “equivalent alternative measure”.
3. Determine the required or needed level of encryption: The U.S. Department of Health and Human Services (HHS) turns to the National Institute of Standards and Technology (NIST) for recommended encryption-level practices. HHS and NIST have both produced robust documentation for adhering to HIPAA’s Security Rule. NIST Special Publication 800-111 takes a broad approach to encryption on user devices. In a nutshell, it states that when there is even a remote possibility of risk, encryption needs to be in place. FIPS 140-2, which incorporates AES into its protocols, is an ideal choice. FIPS 140-2 helps education entities ensure that PII is “rendered unusable, unreadable, or indecipherable to unauthorised individuals”. A device that meets FIPS 140-2 requirements has a cryptographic erase function that “leverages the encryption of target data by enabling sanitisation of the target data’s encryption key, leaving only the cipher text remaining on the media, effectively sanitising the data”.
4. Be mindful of sensitive data transfers and remote access: Encryption must extend beyond laptops and backup drives. Communicating or sending data over the internet requires Transport Layer Security (TLS), a protocol for transmitting data over a network, and AES encryption. When an employee accesses an institution’s local network, a secure VPN connection is essential when ePHI is involved. Also, before putting a handful of student files on a physical external device for transfer between systems or offices, the device must be encrypted and meet FIPS 140-2 requirements to avoid potential violations.
5. Note the fine print details: Unfortunately, many schools fail to diligently review third-party services’ privacy and data security policies and inadvertently authorise data collection and data-mining practices that parents/students find unacceptable or violate FERPA. Regulatory compliance entails much more than simply password-protecting an office’s workstations. It requires encryption to protect data at rest when stored on school systems or removable media devices. Remember, data at rest that is outside the school’s firewall (or “in the wild”) is the top source of security breaches.

Enterprise email encryption is essential for organisations that must protect confidential information, such as financial data, personal information, and intellectual property. Enterprise email encryption uses encryption algorithms to scramble the message into an unreadable format, which can only be deciphered by the intended recipient using a decryption key. This encryption process ensures that the message is secure and cannot be intercepted or read by unauthorised users.

Several email encryption solutions are available for businesses, including Microsoft Purview Message Encryption, S/MIME, Information Rights Management (IRM), and Transport Layer Security (TLS). These solutions provide different levels of encryption and security, and businesses can choose the one that best suits their needs.

The benefits of enterprise email encryption include increased security, compliance with regulatory requirements, and protection of sensitive information. However, some challenges are associated with enterprise email encryption, such as, cost, key management, compatibility, and performance impact.

Proofpoint is an industry-leading cybersecurity company offering several email encryption solutions to help businesses protect their sensitive information sent through email. Proofpoint’s email encryption solutions provide the following benefits:

• Automatic protection: Proofpoint’s email encryption solutions automatically protect messages and attachments with complete transparency, eliminating the need for users to manually encrypt their email to send and receive messages securely.
• Simplified policy management: All email encryption policies are centrally managed and enforced at the gateway, and a convenient graphical interface helps define encryption policies, which can be triggered by messages containing regulated information or intellectual property.
• No-touch key management: Proofpoint’s email encryption solutions eliminate the administrative overhead of key management. As keys are generated, they are securely stored, managed, and made highly available through Proofpoint’s cloud-based infrastructure. Administrators can even allow end-users to revoke, expire, or restore access to encrypted email messages.
• Integrated information protection: Proofpoint’s email encryption solutions make the most of existing investments in Email and Information Protection solutions. The products include over 80 template-based policies, including PCI, HIPAA, PII, and more.

Proofpoint’s email encryption solutions can help businesses protect sensitive information, comply with regulatory requirements, and increase security. To learn more, contact Proofpoint.