What is encryption?
Encryption means that data is transformed into unreadable code that can only be unlocked with the right key. Without the key, the content is worthless to whoever intercepts it, whether that is a stolen laptop, a tapped connection or a hacked server. Encryption protects both data at rest (files on servers, disks and phones) and data in transit (everything sent over the network).
You already use encryption every day: the padlock in the browser, encrypted hard drives, messages in Teams. And it is not just good practice: Datatilsynet, the Danish Data Protection Agency, points to encryption as a central technical measure under GDPR, for example when sending confidential and sensitive personal data by email. Encryption is therefore also a standing control in the work on IT compliance.
Symmetric vs. asymmetric encryption
Symmetric encryption uses the same key to lock and unlock. The standard is AES: fast and strong, and therefore what protects the data itself in practice. The challenge: both parties need to know the key, and how do you share it securely?
Asymmetric encryption solves exactly that with a key pair: a public key everyone may know, and a private key only the owner has. What is encrypted with the public key can only be opened with the private one. The standard is RSA (and increasingly elliptic curves). Asymmetric encryption is slower, so in practice the two are combined: RSA securely exchanges an AES key, which then encrypts the actual traffic.
What is end-to-end encryption?
End-to-end encryption (E2E encryption) means that data is encrypted by the sender and only decrypted by the recipient. No one along the way can read the content. Not the telecoms provider, not the service provider, not an attacker on the network.
The difference from ordinary transport encryption matters: With TLS, the connection to the server is encrypted, but the provider can read the content on the server itself. With end-to-end encryption, only the two endpoints can read along, because the keys exist only with the sender and recipient. It is the principle behind Signal and WhatsApp, and it is especially relevant for email encryption: Ordinary email is not end-to-end encrypted, which is why sending sensitive personal data typically requires an extra layer such as S/MIME or a secure mail solution.
TLS: the encryption behind https
TLS (Transport Layer Security, the successor to SSL) is what turns http into https and draws the padlock in the browser. When you visit a website, the server proves its identity with a certificate, after which browser and server exchange keys and encrypt all traffic. TLS also protects mail traffic between mail servers, API calls and most cloud services. Without a valid certificate: no padlock, and warnings for every visitor.
What are certificates and PKI?
Encryption only protects if you are talking to the right party. Certificates bind a public key to an identity (a domain, a person, a device), and PKI (Public Key Infrastructure) is the system of certificate authorities, policies and processes that make certificates trustworthy. In practice, expired certificates are a classic cause of outages and security holes, which is why managed issuance, monitoring and renewal (PKI management) is an operational task, not a one-off project.
If you want to go deeper into certificates, key protection and eIDAS, we have collected it all in the free e-book PKI and HSM in practice.
How MI Support IT can help
We help with encryption in practice: PKI management with certificates and keys under control, secure email, encrypted devices and compliance requirements, as part of your overall IT security. If you want an overview of where your data is actually protected, contact us.