Data encryption transforms readable data (plaintext) into an unreadable form (ciphertext) using a cryptographic algorithm and key, so that only authorized parties holding the correct decryption key can recover the original information. It is a foundational information security control protecting data confidentiality and integrity across three states: data-at-rest (stored in databases, file systems, or backups), data-in-transit (moving across networks or APIs), and data-in-use (actively being processed — an emerging capability via homomorphic and confidential computing). Encryption does not prevent access attempts; it renders intercepted or stolen data operationally useless without the corresponding key. Encryption is only as strong as its key management: the algorithms, key lengths, and lifecycle controls governing how keys are generated, stored, rotated, and retired determine real-world security posture.
Where it stops · what it isn't
- —Encryption IS: a cryptographic control that protects confidentiality and supports integrity of data at rest, in transit, and increasingly in use, using mathematically proven algorithms (AES-256, TLS 1.3, RSA, ECC) and managed cryptographic keys.
- —Encryption IS NOT: a substitute for access control — encrypting a file does not prevent an authorized user holding the key from misusing its contents, nor does it stop insiders who legitimately hold decryption keys.
- —Encryption IS NOT: the same as hashing — hashing (SHA-256, bcrypt) is a one-way function used for integrity verification and password storage, not reversible decryption. Confusing the two is a common practitioner error.
- —Encryption IS NOT: a complete data protection strategy — it must be paired with access control, data classification, key management governance, and monitoring to form a coherent protection layer.
- —Encryption IS NOT: inherently compliant — using AES-128 when a regulation requires AES-256, or TLS 1.1 when TLS 1.3 is mandated, means encryption is present but the compliance requirement is not met.
- —Key management IS part of encryption — algorithm and key length selection is incomplete without policies for key generation (using approved CSPRNGs), storage (HSMs, KMS), rotation schedules, and secure retirement and destruction.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESPublic Key Infrastructure (PKI)Data Classification
PART OFProtection of Information Assets (CISA Domain 5)
ENABLESHIPAA Safe Harbor Breach ExemptionGDPR Article 32 Technical Safeguard CompliancePCI-DSS Strong Cryptography Requirement
RELATED TONetwork and Endpoint SecurityData Loss Prevention (DLP)Access Control Management
CONSTRAINSPost-Quantum Cryptography Migration Planning