Encryption

Encryption is a security control used mainly to protect the confidentiality of data. Ciphertext appears random and reveals nothing about the content of the original data. The transformation is reversible, and decryption turns ciphertext back into plaintext. Each encryption and decryption function requires a cryptographic key, a string of binary digits.

In symmetric encryption, the encryption and decryption functions use the same key, and the Advanced Encryption Standard (AES) is widely supported in current systems. Asymmetric, or public-key, cryptography uses two separate keys, one to encrypt or digitally sign data and one to decrypt it or verify the signature. Encryption algorithms are made public, so the security of encrypted data depends on keeping the key secret, and a longer key gives an attacker more possible keys to try.

Encryption protects data in transit and at rest. TLS, the successor to SSL, is the primary end-to-end protocol for protecting information that crosses the internet, IPsec is often used to build virtual private networks, and S/MIME lets a sender encrypt email that only the intended recipients can read. For data at rest, system encryption covers a device's whole drive, drive encryption covers removable media, and file encryption covers individual documents. An encrypted drive that is stolen is useless to someone who lacks the key. CISA calls encrypting data at rest and in transit a critical defense against attacks like ransomware and malware.

Encryption depends on key management. Anyone who knows the key can decrypt the data, and if the key is modified or lost the plaintext cannot be recovered, so systems that use encryption need a key recovery mechanism. All copies of sensitive data, including backups, should be encrypted, and data protected by an algorithm that becomes obsolete should be re-encrypted with a current approved one. File encryption protects a document's contents but leaves metadata such as the author and creation date visible.