What is the purpose of encryption - data security protection?

What is the purpose of encryption - data security protection? With the increasing number of data thefts in digital form, data protection on computers and data storage devices has become a priority for many companies that handle confidential and sensitive data in their daily operations.

Protecting sensitive documents is a pressing issue in today's world, and most organizations strive to safeguard sensitive documents from unauthorized access. Encryption, access restriction, and protecting documents behind firewalls are some of the common techniques for securing sensitive information. Additionally, digital document signing and digital watermarks are also used.

Why protect documents?

Many documents within an organization represent a form of intellectual property and business secrets, requiring the highest level of control and protection from unauthorized access and improper use. In today's business environment, the ability to protect documents from unauthorized access, exploitation of document reader vulnerabilities, and inappropriate use is expected. Organizations possessing documents with important and confidential information pay particular attention to the following security aspects:

Confidentiality - Data in documents should only be accessible to authorized users.

Authenticity - Unambiguous identification of authorized users.

Accountability - Monitoring access and changes.

Integrity - Detecting whether a document has been altered.

Origin - Verification of the document's source.

Encryption is an effective means of preventing unauthorized individuals from viewing the contents of a sensitive document. However, when a document is decrypted using a secret key, an authorized person with ill intentions can save, copy, print, or forward the document. Effective protection involves not relying on a single security solution but a combination of multiple security methods.

Encryption

A critical part of protecting data stored on hard drives, especially portable ones, is encryption. This relatively simple process helps prevent the exposure of confidential information in case of a lost or stolen laptop and safeguards against malicious users gaining physical access to the computer. Most modern operating systems have built-in mechanisms for encrypting stored data.

The encryption process involves transforming open or plain text into text that is unreadable to unauthorized individuals. Those who are allowed to read the document must possess a special key to convert the document back into plain text, i.e., decrypt it. There are symmetric and asymmetric cryptographic systems. In a symmetric system, the encryption key is the same as the decryption key, while in an asymmetric system, this is not the case.

Using an Asymmetric Cryptographic System

Asymmetric cryptographic systems are based on certain properties of numbers explored in number theory. The idea is illustrated with the following example: Ana creates a pair of keys, one for encryption and one for decryption. Assuming asymmetric encryption is a form of computer encryption, Ana's encryption key is one number, and her decryption key is another number. Ana keeps her decryption key secret, so it is typically referred to as a private key. However, she publicly publishes her encryption key, often called the public key.

If Ivan wants to send a message to Ana, he simply looks up her public key, which is publicly available in something like a phone book. Then, Ivan uses Ana's public key to encrypt the message and sends it. When the message arrives, Ana can decrypt it with her private key. In this way, anyone can send Ana an encrypted message, and only she can decrypt it because she is the only one with the private key.

Methods for Disk Data Protection

There are software packages that encrypt entire computer hard drives. One such software package is TrueCrypt, used for maintaining and encrypting disks during their use (on-the-fly). This means that data is automatically encrypted or decrypted before it is loaded for display or storage (without user involvement). No data stored on the hard drive can be read without the correct password or decryption key. The entire file system is encrypted, including file names, directories, the content of each file, free space, metadata, and more.

Files can be copied to a disk that is mounted in the TrueCrypt program in the same way as they are copied to or from an unencrypted disk. Files are automatically decrypted in memory (RAM - random access memory) when read or copied from the encrypted TrueCrypt disk. Similarly, files being stored or copied to the disk are automatically encrypted before being written to the disk.

For example, consider a video file with the .avi extension stored on a TrueCrypt disk. This file is completely encrypted. The user enters the correct password and opens the TrueCrypt disk. When the user double-clicks on the video file icon, the operating system launches the application associated with the video file extension, such as VLC. The video player loads only a portion of the encrypted video file into RAM, where it is automatically decrypted. While the decrypted portion is displayed, the next portion of the video file is loaded into RAM, and the process repeats. This process is called on-the-fly encryption and works the same way for all types of files.

Creating an Encrypted Disk

The program never saves decrypted data to the disk but temporarily stores it in RAM. Even when a disk is opened for viewing, the data stored on the disk is still encrypted. When the operating system is restarted or the computer is turned off, the disk is automatically dismounted, and the files stored on it are inaccessible and still encrypted. Even if there is a sudden power outage, the files stored on the disk remain secure. To access the files again, the disk must be mounted in the TrueCrypt program, and the correct password or decryption key must be entered.

Encrypting the entire disk provides the highest level of security achievable at the operating system level because it encrypts all files on the computer.

In addition to TrueCrypt, there are other tools for encrypting computer hard drives. One such tool is eCryptfs, which offers file system-level encryption for Linux operating systems. It encrypts individual files (while TrueCrypt encrypts entire partitions). This type of encryption offers several advantages:

Managing keys at the file level - each file or group of files can be encrypted with an individual key.

Access control through public-key cryptography - files can be made accessible to anyone who possesses the private key corresponding to our public key.

Another encryption tool is FreeOTFE, which offers similar capabilities to TrueCrypt but is only available on the Windows platform. However, it can read and write to containers created on Linux platforms, providing portability. It also offers the option of authentication with security tokens and smart cards (hardware authentication).