Encryption transforms readable data into ciphertext with a key so that only someone holding the right key can turn it back, protecting the data while it is stored or in transit.
Our take. Almost no security failure involving encryption is a failure of the algorithm. The mathematics of modern ciphers is the strongest part of any system; the keys are lost, reused, left in a configuration file or handed to the wrong process. Treat key management as the subject and the cipher as a solved detail.
Two families do the work. Symmetric encryption uses one key for both directions: whoever encrypts can decrypt, and the problem is getting that key to the other party without anyone else seeing it. Asymmetric encryption uses a pair, a public key anyone may hold and a private key only the owner holds, so that anything encrypted to the public key can be read only by the private one. Asymmetric operations are slow and symmetric ones are fast, which is why real systems use the asymmetric pair once to agree a symmetric key and then encrypt the actual data with it. That handshake is what happens in the first moments of every secure web connection.
Where the data is
What encrypts it
What the key protects against
In transit across a network
TLS on the connection, or a VPN tunnel
Anyone on the path reading or altering the traffic
At rest on a disk or in a database
Full-disk or volume encryption, field-level encryption for sensitive columns
Whoever obtains the hardware or a copy of the storage
In use, inside memory
Confidential computing, rarely deployed
An attacker with control of the host
In a backup
The backup tool's encryption, with a key kept elsewhere
The most commonly forgotten copy
The standard symmetric cipher is AES, published as a federal standard and unbroken in practice; the standard asymmetric methods are RSA and, increasingly, elliptic-curve algorithms, with post-quantum replacements being standardised because a sufficiently large quantum computer would break the asymmetric family. None of that should worry a practitioner today. What should is the key: where it is generated, who can read it, how it is rotated, and what happens when the person who knew the passphrase leaves. Encryption with a key stored beside the data is a formatting exercise.
In practice
A web application stores customer records in a database on an encrypted disk, and its developers report that customer data is encrypted at rest. It is, against the theft of the physical drive. It is not against the application itself, which reads the disk transparently, nor against an attacker who compromises the application and asks it for records. Encrypting the sensitive columns with a key the application fetches from a separate key-management service, under an identity that can be audited, changes that: the database administrator sees ciphertext, the backup is useless without the service, and the key can be rotated without touching the data files. The disk encryption was correct and answered a different question.
Hashing is one-way: there is no key and nothing to reverse. Encryption is reversible by design, which is why passwords are hashed and messages are encrypted.
TLS is a protocol that uses encryption, among other things, to protect a connection. Encryption is the underlying operation; TLS is one arrangement of it for traffic in transit.
PKI is the system of certificates and authorities that tells you whose public key you are holding. Asymmetric encryption works without it; trusting the key you were handed does not.
Key takeaways
→Symmetric for speed, asymmetric for exchanging the symmetric key; every real system uses both.
→Encrypted at rest answers one threat; ask which one before accepting the claim.
→Keys fail long before algorithms do; key management is the actual subject.
Certifications that test this
Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.
A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.
Over hundreds of companies today have data struggles but Tableau has brought amazing solutions to all their problems in…
Udemy
FAQ
Is AES-256 better than AES-128?
Longer keys are not weaker, and both are beyond practical attack today. The difference matters for long-lived secrets and for policy compliance; for most systems the choice of cipher is not where risk lives, and the choice of where the key sits is.
Does encrypting a database protect it from a breach?
Against the theft of the storage, yes. Against an attacker who compromises the application that legitimately decrypts the data, no, because the application will decrypt for them too. Field-level encryption with separately held keys narrows that gap; nothing closes it entirely.
Do I need to worry about quantum computers?
Not for the symmetric encryption that protects most data. Asymmetric methods are the exposed part, standards bodies have published replacements, and the practical step is to make sure your systems can change algorithms when the libraries do.
Sources
The primary text this definition rests on. Read it before you trust ours.
FIPS 197, Advanced Encryption Standard (AES) (2001)
