Security · Advanced

Encryption: when, where and how not to get it wrong

In one line: Use known libraries with modern defaults, and invent nothing — almost every encryption failure is a usage failure.

Three states

In transit. Always encrypted, including between internal services. An internal network isn't a safe zone.

At rest. Disks, backups and object storage. In most cloud services that's a setting, not a project.

At the field level. For especially sensitive data, so even database access doesn't expose it. The cost: you can't easily search on it.

Key management is the main thing

The key is stored in a key-management service, not next to the data. Explicit permissions, periodic rotation, and access logging. Encryption with a key sitting on the same server adds little against an attacker who reached the server.

Common mistakes

Outdated encryption modes, reuse of a random value, comparing secret strings in a way that leaks timing, and a fast hash for passwords. All are avoided by using high-level interfaces rather than primitives.

Going deeper

Document per data type: whether it's encrypted, at which layer, who can decrypt, and how long it's kept. That document is needed in any audit anyway, and it usually also reveals two places nobody thought about.

Security Privacy

Next: Cloud permissions: the most important rule is the minimum · Previous: The code supply chain · Back to library