What is encryption?
Encryption converts readable data into ciphertext that only someone with the right key can decode. In practice you encrypt data in transit (with TLS) and at rest (often with AES-256), and the security depends heavily on how you manage the keys.
Definition
Encryption is the process of transforming data into an unreadable form (ciphertext) using an algorithm and a key, so that only parties holding the correct key can convert it back to its original form.
Background
Two forms matter in practice. Symmetric encryption (such as AES-256) uses one shared key and is fast, so it protects data at rest. Asymmetric encryption uses a public/private key pair and underpins things like TLS, which protects data in transit between systems. The algorithms are well understood; the hard and consequential part is key management, generating, storing, rotating, and revoking keys, because a leaked key defeats the encryption.
Why it matters
Encryption is a baseline expectation for protecting sensitive data and a near-universal control in SOC 2, ISO 27001, HIPAA, and PCI DSS. Done well, it means a stolen disk or intercepted connection yields nothing useful.
Step by step
- Encrypt data in transit everywhere using current TLS.
- Encrypt sensitive data at rest, commonly with AES-256.
- Use a proper key-management approach (a managed KMS or HSM) rather than hard-coded keys.
- Rotate and revoke keys, and restrict who can access them.
- Prefer well-tested, standard algorithms over anything home-grown.
Examples
- A SaaS app serves everything over TLS and stores its database encrypted at rest with keys held in a managed key-management service.
- Backups are encrypted before leaving the environment so a lost backup is not a breach.
Common mistakes
- Focusing on the algorithm while neglecting key management, where most real failures happen.
- Rolling your own cryptography instead of using vetted libraries and standards.
- Encrypting at rest but leaving keys accessible next to the data they protect.
FAQ
What is the difference between encryption in transit and at rest?
In transit protects data moving between systems (typically with TLS); at rest protects stored data (often with AES-256). A complete program does both.
Is AES-256 secure?
AES-256 is a widely trusted, standard symmetric algorithm. Its practical security depends on protecting the keys, which is where key management comes in.
Do this in Keel, not a spreadsheet
Keel is the AI-native GRC platform for SMBs: one control-and-evidence graph across SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, and more. Start free, no credit card.
Start free