Catalog
concept#Security#Data#Architecture

Encryption

Encryption protects data by transforming information with mathematical algorithms so it becomes unreadable to unauthorized parties.

Encryption is a fundamental protection mechanism that renders data unreadable to unauthorized parties through mathematical algorithms.
Established
High

Classification

  • High
  • Technical
  • Architectural
  • Advanced

Technical context

Cloud KMS (e.g., AWS KMS, Azure Key Vault)Transport protocols (TLS) in API gatewaysDatabases with Transparent Data Encryption (TDE)

Principles & goals

Principle of minimal attack surface: encrypt only necessary data.Separation of data and key management (separation of duties).Clear key lifecycle and rotation policies.
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Key loss or compromise can lead to data loss or misuse.
  • Incorrect implementation can cause a false sense of security.
  • Incompatible or outdated algorithms break interoperability.
  • Use well-established, standardized algorithms and libraries.
  • Automate key rotation and certificate management.
  • Separate roles for access to keys and data (least privilege).

I/O & resources

  • Data classification and identification of sensitive fields
  • Decision on key management architecture (central KMS/HSM)
  • Threat model and compliance requirements
  • Encrypted data-at-rest and in-transit
  • Documented key policies and rotation schedule
  • Audit and evidence material for compliance

Description

Encryption is a fundamental protection mechanism that renders data unreadable to unauthorized parties through mathematical algorithms. It covers symmetric and asymmetric ciphers, key management, and protocols for storage and transport. Encryption reduces attack surface but requires explicit architectural decisions regarding performance, availability, and regulatory compliance. These trade-offs depend on context.

✔

  • Protects confidentiality and mitigates data leaks.
  • Facilitates compliance with data protection regulations.
  • Reduces risk from physical theft of storage media.

✖

  • Performance overhead for encryption and decryption.
  • Complexity of key management, especially rotation and backup.
  • Encryption alone does not fix application logic vulnerabilities.

  • Encryption latency

    Measure of additional latency introduced by encryption/decryption processes.

  • Key rotation frequency

    Frequency at which keys are rotated or renewed.

  • Number of encrypted records

    Proportion or absolute number of encrypted data objects in the system.

Database encryption in banking

Banks encrypt customer data at rest and use HSMs for key management.

TLS protection for web APIs

APIs are encrypted via TLS with centralized certificate automation.

End-to-end in messenger apps

Messengers use asymmetric key pairs and ratchet-based sessions.

1

Perform asset inventory and data classification

2

Select appropriate algorithms, modes, and key lengths

3

Integrate KMS, define rotation and backup

4

Adapt services and clients and perform tests

5

Establish monitoring, auditing and incident response

⚠️ Technical debt & bottlenecks

  • Legacy encryption libraries need replacement.
  • Insufficient automation for certificate and key management.
  • Missing documentation of key hierarchy and responsibilities.
KMS capacity and latencyKey rotation in distributed systemsHardware security module (HSM) integration
  • Using MD5 or SHA1 for security-critical integrity checks.
  • Transport encryption but storing sensitive data unencrypted.
  • Storing keys on developer machines without access control.
  • Skipping threat modeling leads to incorrect protection scope.
  • Unprotected metadata can leak and enable inference.
  • Incorrect key rotation can cause data loss.
Fundamentals of cryptography (symmetric/asymmetric)Operation of KMS and HSMSecurity-conscious design and secure coding
Protection of sensitive data (confidentiality)Regulatory requirements (e.g., GDPR, PCI-DSS)Availability and performance SLAs
  • • Legal constraints for key retention and export control
  • • Legacy systems without encryption support
  • • Limited resources on edge or IoT devices