Unit 2ConceptsObjective 1.48 min read

Encryption Levels, Hardware Tools, and Obfuscation

Unit 2: Change Management and Cryptography. Lesson 9 of 54 in SecPlus Academy.

Where you encrypt decides what a thief actually gets. And the safest place to keep a key is somewhere software cannot read it.

Levels of encryption

Full-disk: the entire drive. A stolen laptop yields nothing without the passphrase or TPM.
Partition and volume: one partition or logical volume, leaving others readable.
File: individual files, protected even when copied elsewhere.
Database: the whole database store. Record: individual fields or rows, so a card number is encrypted while the rest of the row is searchable.
Transport and communication: data moving between systems, using TLS, IPsec, or SSH.

Pick the level that matches the threat: a lost device needs full-disk; a database administrator who should not see card numbers needs record-level.

Hardware for keys

TPM: a chip on the motherboard that stores keys and measures the boot process. Full-disk encryption ties the key to the TPM so the disk only unlocks in its own machine.
HSM: a dedicated tamper-resistant appliance or card that generates, stores, and uses keys at scale. Certificate authorities and payment systems use them.
KMS: a key management service, usually cloud-hosted, that creates, rotates, and controls access to keys for applications.
Secure enclave: an isolated area of a processor that handles secrets such as biometric templates, separate from the main operating system.

A key management system (KMS) is the software or service that generates, stores, rotates, and retires keys at scale, often backed by an HSM.

Obfuscation

Making data less useful to whoever sees it, without full encryption.

Steganography: hiding data inside another file, such as an image or audio, so its existence is concealed.
Tokenization: replace sensitive data with a random token and keep the real value in a separate vault. Payment systems store tokens, not card numbers.
Data masking: show only part of a value, such as the last four digits, to people who do not need the whole thing.

Exam tip: "a stolen laptop's data must be unreadable" is full-disk encryption, often with a TPM. "The card number is replaced by a stand-in value" is tokenization. "Hidden inside an image" is steganography. "Show xxxx-xxxx-xxxx-1234" is masking.

Remember

Full-disk for lost devices, record-level for one field. TPM on the board, HSM in the rack, KMS in the cloud, enclave in the chip. Steganography hides, tokenization substitutes, masking partially reveals.

Deeper explanation

Encryption Levels, Hardware Tools, and Obfuscation, explained slowly

Where to put the lock decides what the thief gets

Encryption can be applied at different levels, and each level answers a different threat. Picture a filing cabinet.

Full-disk        the whole cabinet is welded shut       lost or stolen laptop
Partition/volume one drawer is locked                   separate sensitive from ordinary data
File             one folder is locked                   protection follows the file when copied
Database         the whole database store is locked     stolen database files are unreadable
Record           one line on one page is locked         the DBA can run queries but never sees card numbers
Transport        the courier's van is armored           data on the network between systems

The exam gives a threat and wants the level.

"Laptops are being stolen from cars": full-disk encryption. Even the operating system files are unreadable without the key.
"Database administrators must not be able to read customer card numbers": record-level, encrypting that column with a key the DBA does not hold.
"Files copied to USB drives must stay protected": file-level, because the protection travels with the file.
"Data between the web server and the database must be protected": transport encryption, TLS.

Where to keep the keys

Encryption is only as strong as the place the key lives. If the key sits in a file next to the data, the thief gets both. The exam names four hardware or service answers.

TPM (Trusted Platform Module): a chip on the motherboard. It stores keys so they never appear in software, and it measures the boot process so tampering with the bootloader is detected. Full-disk encryption ties the disk key to the TPM: the drive only unlocks in its own computer, and only if the boot chain is unmodified.
HSM (Hardware Security Module): a dedicated tamper-resistant device, an appliance in a rack or a card in a server. It generates and stores keys and performs signing and encryption inside itself, so the key is never exposed. Certificate authorities, payment processors, and code-signing systems use them.
KMS (Key Management Service): a service, usually in the cloud, that creates keys, controls who may use them, rotates them, and logs every use. Applications ask the KMS to encrypt or decrypt instead of holding keys themselves.
Secure enclave: an isolated region inside a processor with its own memory that the main operating system cannot read. Phones keep fingerprint and face templates and payment keys there.

Quick distinction: TPM is per machine and built in; HSM is a separate high-assurance device; KMS is a managed service; the enclave is inside the CPU.

Obfuscation: making data less useful without full encryption

Steganography hides the existence of data by embedding it in something innocent: a message in the low bits of an image, or in the silence of an audio file. The observer does not know there is anything to look for.
Tokenization replaces a sensitive value with a random token. The real value is stored in a separate, tightly protected vault, and only the vault can map the token back. A store that keeps tokens instead of card numbers has nothing worth stealing.
Data masking shows only the part of a value that a person needs: the last four digits of a card, the first letter of a surname. The full value still exists, but the display is limited.

Original card number   4111 1111 1111 1234
Tokenized              tok_8f3a9c2e (vault maps it back)
Masked                 xxxx xxxx xxxx 1234
Encrypted              3kd9$Lp0... (key maps it back)

How the exam asks it

"Ensure a stolen laptop's data cannot be read." Full-disk encryption with a TPM.
"Store keys so they cannot be extracted even by administrators." HSM.
"A cloud application needs centralized key creation and rotation." KMS.
"Hide a message inside an image file." Steganography.
"Retailer stores a substitute value instead of the card number." Tokenization.
"Customer service sees only the last four digits." Data masking.

What to memorize

Match the encryption level to the threat: full-disk for lost devices, record for one column, file for portability, transport for the wire.
TPM on the board, HSM in the rack, KMS in the cloud, enclave in the chip.
Steganography hides, tokenization substitutes, masking partially reveals.