What it means
Encryption uses a cryptographic algorithm and key to transform readable data into ciphertext. Its value depends on where it is applied and who can use the key. Transport encryption protects a connection between endpoints; storage encryption protects data in a particular stored form. Neither automatically prevents an authorized application from disclosing the plaintext it can read. Implementations should use maintained libraries and established protocols, with a plan for key generation, access, rotation, recovery, and retirement. Integrity protection also matters: confidentiality alone does not establish that data was not altered.
AN ILLUSTRATIVE SCENARIO
A clinic exports research records
A clinic sends an approved dataset to a research partner. The transfer uses an encrypted connection and the receiving storage has encryption enabled. The clinic still checks that the dataset contains only the permitted information and that the partner's account permissions are appropriate. For its own retained encrypted archive, the clinic tests recovery of the required key through a controlled procedure. A lost key could make the archive unreadable even though all the encrypted files remain present.
Put it to work
- Identify which data needs protection, who is allowed to read it, and the threats to transmission and storage. Map every place plaintext is created, processed, logged, or exported.
- Use supported platform encryption and vetted libraries rather than designing a cipher. Configure appropriate authenticated encryption or secure transport, and limit access to the associated keys and plaintext.
- Document key ownership, rotation, recovery, and revocation. Include encrypted backups and dependent services in recovery tests, and ensure logs or temporary files do not bypass the intended protection.
How to check your work
Check that the intended connection or stored object is encrypted, unauthorized identities cannot obtain plaintext, and authorized recovery works. Inspect one complete data flow for unprotected exports, logs, caches, and backup copies rather than checking a single settings page.
Connect the ideas
- TLS
A protocol that encrypts and integrity-protects an application conversation and checks a certificate for a name.
- Secrets management
Storing, rotating, and auditing passwords, keys, and tokens so they are not copied into chat or source.
- Confidentiality
The property that information is available only to people or systems authorized to see it.