Encryption

Encryption turns readable information, called plaintext, into an unreadable form, called ciphertext, using an algorithm and a secret value known as a key. The algorithm is public and well tested; the key is the only secret. Whoever holds the right key can reverse the process, and everyone else sees noise.

It is the main technical way to keep information confidential when the medium cannot be trusted: a stolen laptop, a copied backup, a cable in someone else's building. That is why it sits at the core of data protection programs, and rules on personal and payment data, from the GDPR to PCI DSS, regularly point to it as a safeguard.

Whatever the product, one cycle repeats: a key and an algorithm lock the data, and the same cycle run in reverse opens it.

1. 1

   Choose an algorithm and a key

   Use a standard, well-reviewed algorithm such as AES and a key generated from a strong random source.

2. 2

   Encrypt

   The algorithm mixes the plaintext with the key, usually adding a fresh random value for each message, and produces ciphertext.

3. 3

   Store or send

   The ciphertext can sit on a disk or travel across the internet. Without the key it reveals nothing about the content.

4. 4

   Decrypt

   A holder of the right key runs the process in reverse and gets the original data back; a wrong key gives only unreadable garbage.

Because strong algorithms are public, encryption mostly fails through its keys, not its mathematics. It does not remove the risk, it moves it from the data to the key, so the key needs a lifecycle of its own:

• Generate keys with a trusted random source and a standard tool.
• Store keys apart from the data they protect, in a key manager or a hardware module.
• Limit who and what can use each key, and log every use.
• Rotate keys on a schedule and after any suspected exposure.
• Back up keys with a recovery process, because a lost key makes data unreadable for good.
• Destroy keys when data must disappear: deleting the key can make the data unrecoverable, a method known as cryptographic erase.

Encryption works at several layers, and each answers a different threat. Disk and file encryption protect data at rest, while transport encryption covers data on the move.

Encryption protects data from people who do not have the key. It does nothing about people who do: an employee who opens an encrypted file sees it in clear, and the same session can send it to a personal mailbox. That is why encryption complements data loss prevention and does not replace it, and why data exfiltration often leaves through perfectly encrypted channels.

It also cuts both ways. Ransomware uses the same techniques to lock a victim's files, and widely used public-key algorithms such as RSA and elliptic-curve cryptography could be broken by a large enough quantum computer, which is why standards bodies have already published post-quantum algorithms.

Most web traffic is encrypted, so an agent that ignored it would miss most transfers. In the Anexet console, the network traffic interception settings let the agent substitute server certificates with ones issued by a trusted root, so that encrypted web traffic can be analyzed under web traffic monitoring rules. The certificate can be generated automatically or be the company's own, and a hosts filter excludes chosen sites.

Encryption is often confused with techniques that also change how data looks but behave differently. Hashing is one-way, encoding such as Base64 is only a format change, and data masking replaces values for tests or screens. Only encryption pairs reversibility with a secret key.

Start from the data, not the tool: find out what is sensitive and where it lives, then encrypt the stores and channels that hold it, using standard algorithms and a key manager. Write down who owns each key and how it is rotated and recovered. Finally, check what happens after decryption, because authorized users still need oversight.