We identify four layers: application, transport, database, and storage. Encrypting specific objects and data at each layer is essential to prevent vulnerabilities that attackers could exploit.
Get Long Vu’s stories in your inbox
Join Medium for free to get updates from this writer.
Application layer encryption
The application layer must manage column encryption, data masking, and application keys.
Press enter or click to view image in full size
Press enter or click to view image in full size
Press enter or click to view image in full size
Press enter or click to view image in full size
Transport layer encryption
We manage SSL/TLS, certificate management, and session keys at the transport layer.
Press enter or click to view image in full size
Press enter or click to view image in full size
Press enter or click to view image in full size
Database layer encryption
Dig deeper into the database, we have Transparent Data Encryption, Key Management, and Access Control.
Press enter or click to view image in full size
Press enter or click to view image in full size
Press enter or click to view image in full size
Storage layer encryption
In the final layer, we manage File System Encryption, Backup Encryption, and Key Storage at the storage layer.
Press enter or click to view image in full size
Press enter or click to view image in full size
Press enter or click to view image in full size
We must enhance our access level management by defining role-based permissions, ranging from basic users to super admins. Each higher role should oversee the roles and permissions of lower levels in a hierarchical structure.
Additionally, we should establish dynamic roles and implement temporary permissions based on specific contexts.
Press enter or click to view image in full size
Press enter or click to view image in full size
Press enter or click to view image in full size
Encryption algorithms
Depending on data sense in a specific layer, we have some algorithms that fit with it: AES-256 is used for TDE, Deterministic AES is tailored to database columns, and Randomized AES fits sensitive fields. Etc.
Each algorithm has pros and cons; we must trade-offs when applying them.
Press enter or click to view image in full size
AES-256: - Encrypts entire database at disk level - Transparent to applications (no code changes needed) - High performance with hardware acceleration - Centralized key management - Meets compliance requirements (HIPAA, PCI DSS) - Comprehensive protection: data files, logs, backups
Deterministic AES: - Enables searching on encrypted data - Supports indexing - Allows unique constraints - Supports exact match queries - Efficient for searchable fields (email, phone, SSN) - Maintains data integrity with unique values
Randomized AES: - Highest security for sensitive data - Prevents pattern analysis - Conceals identical data relationships - Perfect for passwords and secrets - Different ciphertext for each encryption - Maximum protection against frequency attacks
XTS-AES: - Specifically designed for disk encryption - Supports random access to encrypted data - Sector-level independence - High performance for large storage systems - Protection against data manipulation - Suitable for filesystem-level encryption
AES-GCM: - Combines encryption and authentication - Built-in data integrity verification - High performance for large datasets - No padding required (reduces complexity) - Detects tampering with encrypted data - Efficient parallel processing support
Encrypting data is crucial for securing information and preventing hackers. However, besides its benefits, it makes the system more complex, increases latency, and requires more maintenance effort.
