DataTerminology.comNEW
Also known as: Cryptography
Process that transforms plaintext into ciphertext using cryptographic algorithms and keys to prevent unauthorized access.
DESCRIPTION
Data encryption safeguards confidentiality for data at rest and in transit. Common approaches include symmetric algorithms (e.g., AES) and asymmetric schemes (e.g., RSA, ECC) for key exchange and digital envelopes. Strong key management and HSMs or cloud KMS services are essential to prevent compromise. Encryption introduces performance overhead and operational considerations like rotation and envelope keys. It complements access controls and monitoring within a defense-in-depth strategy.
ALTERNATIVE DEFINITIONS
NIST CSRC Glossary
The process of transforming plaintext into ciphertext using a cryptographic algorithm.
Concise, algorithm-focused definition from a standards body.
ENISA
Encryption is a process of converting information into a form that is unreadable to anyone except holders of a specific cryptographic key.
Highlights the role of keys and authorized access.
RELATED TERMS
Key Management Symmetric Encryption Asymmetric Encryption TLS Hashing Hardware Security Module Data at Rest Encryption End-to-End Encryption Zero Trust
COMPETING TERMS
RELATIONS
- Broader: Encryption
KNOWLEDGE AREAS
Data Security Infrastructure Cloud Data Management
TARGET AUDIENCE
Software Developer DevOps Engineer Cloud Architect Data Engineer Chief Information Officer Chief Technology Officer
EXTERNAL SOURCES
- Wikipedia - Encryption
- NIST - Authoritative glossary definition
- NIST - Guideline for cryptographic standards
- OWASP - Implementation best practices
TOP QUESTIONS
What is the difference between symmetric and asymmetric Data Encryption?
Symmetric uses one shared key for encryption and decryption; asymmetric uses public/private key pairs. Asymmetric is slower but simplifies key exchange and supports digital signatures.
Category: Example
When should I use encryption at rest versus in transit?
Use both. At-rest encryption protects stored data from media theft or unauthorized access; in-transit encryption (e.g., TLS) protects data on the network.
Category: BestPractice
How do cloud KMS services help with Data Encryption?
KMS centralizes key generation, storage, rotation, and access control. It reduces operational risk and supports auditability and regulatory compliance.
Category: Management
Does encryption alone ensure data security?
No. Encryption must be combined with access controls, monitoring, patching, and incident response. Poor key management can nullify encryption benefits.
Category: Misunderstanding
What are performance considerations of Data Encryption?
Encryption adds CPU overhead and latency. Hardware acceleration (AES-NI), efficient cipher modes, and envelope encryption patterns mitigate performance impacts.
Category: Requirements
What is envelope encryption in Data Encryption?
It encrypts data with a data key and encrypts that key with a master key. This simplifies rotation and reduces exposure of master keys.
Category: Example
How often should encryption keys be rotated?
Follow policy and risk-based intervals, commonly 6–12 months or on compromise. Automate rotation via KMS and re-encrypt data keys as needed.
Category: BestPractice
What standards guide strong Data Encryption?
Use NIST-approved algorithms (e.g., AES-256, RSA-2048+), FIPS 140-validated modules where required, and proven protocols like TLS 1.2+.
Category: Standard
Is hashing the same as Data Encryption?
No. Hashing is one-way for integrity and passwords; encryption is reversible with keys to maintain confidentiality.
Category: Misunderstanding