Encrypting Data - CompTIA Security+ SY0-701 - 1.4 — Transcript

Full transcript

1. 0:02if you need to protect data that you're
2. 0:03storing on an SSD a hard drive or any
3. 0:06other type of storage device then you'll
4. 0:08need to work on encrypting all of this
5. 0:10stored data sometimes you'll hear this
6. 0:12referred to as encrypting data at rest
7. 0:15this includes not just individual files
8. 0:17that you might have on these storage
9. 0:19devices but in some cases everything
10. 0:22that's on the storage devices using full
11. 0:24dis or volume level encryption in the
12. 0:26Windows operating system you may be
13. 0:28using bit Locker to Lish this if you're
14. 0:31using Macos you may be using file Vault
15. 0:34and other operating systems have other
16. 0:36ways for encrypting everything on a
17. 0:38single volume you might also need to
18. 0:40encrypt a single file that is on a
19. 0:42system and not the entire volume in
20. 0:45Windows you can use EFS this stands for
21. 0:47the encrypting file system it's a file
22. 0:50level encryption that's built into the
23. 0:51NTFS file system and if you're using Mac
24. 0:54OS Linux or even Windows there are many
25. 0:57third-party utilities that can perform a
26. 0:59a similar function in Windows you would
27. 1:02look at the properties of a file or
28. 1:03folder and inside the advanced
29. 1:05attributes you can select encrypt
30. 1:08contents to secure data to enable
31. 1:11EFS a lot of the data that we use online
32. 1:14is stored in a database and of course
33. 1:16there are different techniques to be
34. 1:18able to protect the data that's inside
35. 1:20of these database files for example you
36. 1:23may be able to configure transparent
37. 1:25encryption this uses a symmetric key to
38. 1:28encrypt everything that might be in that
39. 1:30database and you would need to perform
40. 1:32an encryption or decryption of that data
41. 1:35each time the information is pulled from
42. 1:37the database some of the information in
43. 1:39your database might not be private or
44. 1:41sensitive so you might have some data
45. 1:43inside of the database that is protected
46. 1:46or encrypted and other data which is
47. 1:48still available in plain text here's an
48. 1:51example of a table inside of a database
49. 1:54this is an employee database that has
50. 1:56employee ID numbers first names last
51. 1:59names names and Social Security numbers
52. 2:02of course you could encrypt the entire
53. 2:04database by applying a symmetric key so
54. 2:07that all of this data is now encrypted
55. 2:09and you can see we have no idea what
56. 2:12part of this may have anything to do
57. 2:14with an employees name their ID number
58. 2:16or their social security number but of
59. 2:19course there's overhead involved in
60. 2:21being able to view this information and
61. 2:23every time we need to search through the
62. 2:25entire database we would effectively
63. 2:27need to decrypt all of the data Within
64. 2:29that single database one way to avoid
65. 2:32some of that overhead is to only encrypt
66. 2:34a certain type of data in the database
67. 2:37in this example we're performing column
68. 2:39level encryption where the employee ID
69. 2:42the first name and the last name are all
70. 2:44displayed in plain text and if you
71. 2:46needed to search for a name or search
72. 2:48for an ID you can perform this very
73. 2:50quickly without having to decrypt any
74. 2:52other type of data but if you needed
75. 2:54access to a person's social security
76. 2:56number you would either need to decrypt
77. 2:58the entire column or that single record
78. 3:00to be able to gain access to that
79. 3:02data another common place to perform
80. 3:05this encryption is when we're sending
81. 3:07data across the network we want to be
82. 3:09sure that everything we're sending
83. 3:10between two devices is protected and if
84. 3:12someone does tap into this connection
85. 3:14and view that data they wouldn't be able
86. 3:16to make sense of any of those details
87. 3:19for example you're probably using a
88. 3:20browser right now to watch this video
89. 3:22and all of the communication that's
90. 3:24taking place in your browser is most
91. 3:26likely using https which means that
92. 3:28everything Travers ing the network is
93. 3:30encrypted if you need to connect
94. 3:32different sites to each other or need to
95. 3:34connect individuals for remote access we
96. 3:37commonly would use a VPN to provide this
97. 3:39encryption this stands for virtual
98. 3:41private Network and it effectively
99. 3:43creates an encrypted tunnel where you
100. 3:45can send all information into the tunnel
101. 3:47to the other side and anything within
102. 3:49that tunnel is going to be encrypted
103. 3:52this is commonly used with client-based
104. 3:54vpns using SSL or TLS and if you're
105. 3:57connecting two sites together we
106. 3:59commonly we use use IPC to provide that
107. 4:01VPN
108. 4:02connectivity to be able to have a
109. 4:05successful encryption and decryption
110. 4:07both sides must be using the same
111. 4:09encryption algorithms this is the
112. 4:11formula that's used to not only provide
113. 4:14the encryption process but it also
114. 4:16provides you with the way to decrypt
115. 4:18that data on the other side generally
116. 4:21both sides would agree from the very
117. 4:23beginning to use one or more encryption
118. 4:25algorithms so that both sides know
119. 4:28exactly what to expect when information
120. 4:30is received many times the enduser
121. 4:33doesn't see the details of the
122. 4:34algorithms that are being used but they
123. 4:36know that they're using a particular
124. 4:38application and they want to be sure the
125. 4:40person on the other side is using a
126. 4:42similar application so that the
127. 4:43encryption and decryption processes will
128. 4:46be compatible there are obviously
129. 4:48advantages and disadvantages depending
130. 4:50on what encryption algorithm you're
131. 4:51using some algorithms have a better
132. 4:54security level some work faster than
133. 4:56others some have a more complex method
134. 4:58for implement mation but once both sides
135. 5:01agrees on the application that will be
136. 5:03used for encryption and decryption
137. 5:05everything else generally takes care of
138. 5:07itself automatically usually the
139. 5:09Security administrator will have a
140. 5:11pretty good idea of what the
141. 5:13requirements are for the users and
142. 5:15they'll make sure that the proper
143. 5:16encryption algorithms are used here's a
144. 5:19good example of why it's so important
145. 5:21that both parties in a conversation are
146. 5:23using the same encryption algorithm
147. 5:25these are very broad comparisons between
148. 5:27the desk encryption algorithm and the
149. 5:29AES encryption algorithm these stand for
150. 5:32the data encryption standard and the
151. 5:34advanced encryption standard you do not
152. 5:37need to know the specifics of these
153. 5:39block diagrams for the Security Plus
154. 5:41exam but you can visually see that there
155. 5:44are quite a few differences between both
156. 5:46of these algorithms the desk encryption
157. 5:48algorithm has five different steps which
158. 5:50include breaking up the data into a left
159. 5:52plane text and right plain text to
160. 5:55finally come up with a 64-bit Cipher
161. 5:57text you can see that AES Works a little
162. 5:59a little bit differently where you take
163. 6:00a plain text and a secret key add it to
164. 6:02a cipher and finally get the cipher text
165. 6:05there are also different versions of AES
166. 6:08that can produce different levels of
167. 6:09output you obviously would not be able
168. 6:12to encrypt with desks and somehow
169. 6:14decrypt with AES you have to be sure
170. 6:16that you're using compatible encryption
171. 6:19and decryption algorithms on both sides
172. 6:21of the
173. 6:22conversation here's another interesting
174. 6:24part about encryption algorithms is we
175. 6:26know exactly how they work the
176. 6:28algorithms themselves are usually public
177. 6:31you can read the code or look through
178. 6:32the math and see exactly the process
179. 6:35that occurs the algorithm is usually a
180. 6:37very well-known thing in fact it makes
181. 6:39the algorithm more trustworthy because
182. 6:41we can see the math and the process
183. 6:43that's used to create the encryption the
184. 6:46one major piece of information that we
185. 6:47don't have is the key and although we
186. 6:50know how the algorithm works we still
187. 6:52are not able to reverse engineer
188. 6:54anything unless we have that key this is
189. 6:57very similar to the way that a door lock
190. 6:59operates we know how door locks work we
191. 7:02know how to manufacture door locks we
192. 7:05know what happens inside of a door lock
193. 7:07when you put a key in but just knowing
194. 7:09that information doesn't somehow allow
195. 7:11you access through a lock door you have
196. 7:14to have the proper key just as you do
197. 7:16with encryption and decryption that key
198. 7:20helps determine the final output if
199. 7:22you're encrypting data or hashing data
200. 7:24or creating a digital signature it's all
201. 7:26based around that key and even though we
202. 7:28have the algorithm and understand
203. 7:30everything about the math you still need
204. 7:32the key to be able to gain access to the
205. 7:35data this is why we always tell you to
206. 7:37keep those private Keys private if
207. 7:40somebody gains access to your key
208. 7:41they're able to use it on your door lock
209. 7:43and now they have access to all of your
210. 7:46data like anything else your encryption
211. 7:48and decryption keys are subject to Brute
212. 7:51Force attacks which means that an
213. 7:53attacker could go through every possible
214. 7:55permeation to be able to determine what
215. 7:57a public or private key might be we can
216. 8:00effectively prevent these Brute Force
217. 8:02attacks from being successful by
218. 8:04creating a very very long key in the
219. 8:07world of encryption a symmetric key of
220. 8:09128 bits or larger would be very common
221. 8:12and today would be very protected as
222. 8:15time goes on and our processors become
223. 8:16more powerful and we're able to tie many
224. 8:19different processors together we may
225. 8:21increase the size of our keys to make
226. 8:23them that much more difficult to Brute
227. 8:26Force this extension of the key links
228. 8:28also applies to asymmetric encryption as
229. 8:30well even though an asymmetric key
230. 8:32involves complex mathematics surrounding
231. 8:34very large prime numbers an attacker can
232. 8:37still perform a brute force and it's not
233. 8:39uncommon to see asymmetric keys that
234. 8:41have a key length of 372 bits or even
235. 8:45larger this means as time goes on we may
236. 8:48have to create larger and larger Keys
237. 8:50just to keep up with the changes in
238. 8:52technology but there are some other
239. 8:54things we can do to make our existing
240. 8:56keys that much more secure and and one
241. 8:59of the ways to do that is to perform the
242. 9:01encryption process multiple times on the
243. 9:04single type of data for example you may
244. 9:07want to Hash a password then hash the
245. 9:09hash of that password then hash the hash
246. 9:12of the hash of that password and so on
247. 9:14this is referred to as key stretching or
248. 9:17key strengthening this means if someone
249. 9:19wanted to Brute Force some data that's
250. 9:21been encrypted multiple times using this
251. 9:24key stretching method that they would
252. 9:26need to decrypt multiple times to see if
253. 9:29their brute force was successful and
254. 9:31this adds an additional overhead and
255. 9:33certainly would create more time during
256. 9:35the Brute Force
257. 9:46process