Data Encryption Methods

𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝗛𝗧𝗧𝗣𝗦 𝗘𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻: 𝗔 𝗦𝘁𝗲𝗽-𝗯𝘆-𝗦𝘁𝗲𝗽 𝗣𝗿𝗼𝗰𝗲𝘀𝘀 HTTPS encryption is crucial for securing online data exchanges. Here’s a breakdown of how it works, focusing on the key steps involved in establishing a secure, encrypted connection between a browser and a server. 𝗛𝗼𝘄 𝗛𝗧𝗧𝗣𝗦 𝗘𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻 𝗪𝗼𝗿𝗸𝘀 1. 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻 𝗥𝗲𝗾𝘂𝗲𝘀𝘁: The browser initiates a secure HTTPS connection with the website. 2. 𝗦𝗲𝗿𝘃𝗲𝗿’𝘀 𝗣𝘂𝗯𝗹𝗶𝗰 𝗞𝗲𝘆: The server responds by sending its public key, included in its SSL/TLS certificate. This key is used to verify the server’s identity. 3. 𝗦𝗲𝘀𝘀𝗶𝗼𝗻 𝗞𝗲𝘆 𝗚𝗲𝗻𝗲𝗿𝗮𝘁𝗶𝗼𝗻: The browser generates a unique session key for this particular connection. 4. 𝗔𝘀𝘆𝗺𝗺𝗲𝘁𝗿𝗶𝗰 𝗘𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻: The browser encrypts the session key with the server’s public key and sends it to the server. This is 𝗮𝘀𝘆𝗺𝗺𝗲𝘁𝗿𝗶𝗰 𝗲𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻—a method where a pair of keys (a public key and a private key) is used. The public key encrypts data, while only the corresponding private key can decrypt it. This ensures that only the intended server can access the session key. 5. 𝗦𝘆𝗺𝗺𝗲𝘁𝗿𝗶𝗰 𝗘𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻: Once the server receives the encrypted session key and decrypts it using its private key, both the browser and server use this session key for 𝘀𝘆𝗺𝗺𝗲𝘁𝗿𝗶𝗰 𝗲𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻. In symmetric encryption, the same key is used for both encryption and decryption, making it faster and more efficient for continuous data exchange. 6. 𝗦𝗲𝗰𝘂𝗿𝗲 𝗗𝗮𝘁𝗮 𝗧𝗿𝗮𝗻𝘀𝗳𝗲𝗿: All data exchanged in this session is encrypted with the session key, ensuring confidentiality and integrity of the information. 𝗪𝗵𝘆 𝗛𝗧𝗧𝗣𝗦 𝗠𝗮𝘁𝘁𝗲𝗿𝘀 This process ensures that sensitive information—such as login credentials, payment data, and personal information—is encrypted and secure during transmission. HTTPS provides: - 𝗖𝗼𝗻𝗳𝗶𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝗶𝘁𝘆: Data remains private and unreadable by third parties. - 𝗜𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆: Data is protected from tampering during transmission. - 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻: Verifies the server’s legitimacy, safeguarding against malicious actors. In an era where data security is non-negotiable, HTTPS encryption is essential for protecting information and establishing trust in digital interactions.

🚩 The US government pushes for PQC adoption and extensive use of cryptography. On Jan. 16th, 2025, the Biden administration published the "Executive Order on Strengthening and Promoting Innovation in the Nation’s Cybersecurity" (EO 14144). The Trump administration revoked several Biden Executive Orders on the inauguration day, but this EO was not one of them. This EO shows near-future requirements by US agencies to their vendors. These requirements may permeate to the financial sector as requisites from US agencies to their providers or as features that will be more relevant in major technology products and offerings. It also shows interesting trends on actions that may need to be prioritized. The EO focuses on making cybersecurity controls effective to avoid organizations and the supply chain to comply minimally with no impact in improving security. It seeks accountability of software and cloud services providers.  👉 Highlights on cryptography There are several requirements promoting the use of cryptography and accelerating the transition to PQC: ✔ Use of public-key cryptography to implement phising-resistant authentication. ✔ Implement Internet routing protections to defend against malicious traffic diversions ✔ Implement cryptography-protected DNS, email, voice, videoconference and instant messaging. ✔ Implement PQC "as soon as practicable". ✔ Improve key management onprem and in the cloud. I appreciate the expanded focus on means to achieve data protection: 👍 Introducing or improving cryptography in various processes and protocols. 👍 Protecting Internet traffic routing, as it is a first step for HNDL attacks. More details: 📌 The order highlights “the People’s Republic of China presenting the most active and persistent cyber threat” to the US. 📌 Use of Route Origin Authorizations and performing Route Origin Validation filtering. 📌 NIST to publish updated guidance on BGP security methods, route leak mitigation and source address validation. 📌 Encrypted DNS must be deployed wherever supported. 📌 Email messages must be encrypted in transport and, where practical, use end-to-end encryption. 📌 Expand the use of authenticated transport-layer encryption between email servers and with clients. 📌 Voice, VCand IM must enable transport encryption and use end-to-end encryption by default. 📌 Implement PQC key establishment or hybrid key establishment including a PQC algorithm as soon as practicable upon support from the vendors. 📌 Support TLSv1.3 ASAP but no later than 2029. 📌 Cryptographic keys with extended lifecycles should be protected with HSMs, TEEs, etc. Executive order: https://lnkd.in/d-ifZtrf National Institute of Standards and Technology (NIST) responsibilities: https://lnkd.in/dnhUbrfH #pqc #cryptography #cybersecurity #policy

I successfully tested the YellowKey BitLocker 0-day and was able to access a machine protected with BitLocker. This setup is probably used by 99% of companies that enable BitLocker - and now it can be bypassed. An attacker just needs physical access to a device, opportunity to boot to Windows Recovery Environment Agent (this can be done without logging in!) and a USB drive with the exploit. This is probably the most serious physical access vulnerability in years. There is no patch currently, so few defensive measures worth reviewing: - Use TPM + PIN where possible. BitLocker with TPM-only can be convenient, but adding a pre-boot PIN significantly raises the bar for offline/physical attacks. - Lock down BIOS/UEFI settings. Set a strong BIOS/UEFI administrator password. - Treat physical access as a serious threat model. For high-risk laptops, privileged admin workstations, and sensitive environments, assume that a lost or temporarily accessed machine may be attacked offline.

Lets Learn #Quantum – Post #16: Post-Quantum Cryptography (PQC) The Invisible Safe: Why Hackers Are Stealing Data They Can't Read Yet The biggest short-term impact of quantum computing isn't what it can create. It is what it can destroy. Right now, our digital world relies on encryption algorithms like RSA to protect banking, emails, and cloud data. Standard supercomputers would take thousands of years to crack them. But quantum computers change the rules. Running Shor’s Algorithm, a quantum computer could break today's encryption in hours. The Threat Happening Right Now Why care today if full-scale quantum computers are still year away? Because cybercriminals are actively executing a strategy known as Harvest Now, Decrypt Later (HNDL). Imagine a thief stealing a locked titanium safe. They cannot open it today, so they hide it in a basement and wait. Years from now, a new tool is invented that pops that safe open instantly. That is HNDL. Bad actors are intercepting and archiving sensitive enterprise data today, waiting for the day a quantum computer can unlock it. If your data needs to remain secret for the next decade, it is already at risk. Enter PQC: Upgrading the Locks Post-Quantum Cryptography (PQC) is the defense. It is a new generation of math shields designed to resist attacks from both conventional and quantum computers. The breakthrough? PQC runs seamlessly on your current servers, smartphones, and cloud platforms. Think of it as swapping out a traditional door lock for a multi-dimensional biometric scanner. The house stays the same; only the lock changes. Instead of traditional math, PQC relies on Lattice-Based Cryptography. Think of it like a maze with thousands of overlapping dimensions instead of two. Even a quantum computer gets completely lost trying to find the exit. The Strategic Reality You cannot swap out the security architecture of a global enterprise overnight. Migrating infrastructure takes years, which is why forward-thinking leaders are already auditing networks and testing PQC algorithms today using a hybrid approach. The quantum threat is not a future IT issue. It is a current strategic risk. The question for leadership is no longer: "When will a quantum computer be built?" The real question is: "Will our data still be secure when it arrives?" #QuantumTechnology #PostQuantumCryptography #PQC #QuantumSecurity #CyberSecurity #QuantumComputing #DigitalTransformation #DataProtection #TechnologyLeadership Co-authored with Atul Tripathi Sundar Ram, Sachin Arora, Himanshu Ghawri, Azizur Rahman, Shivendra singh, Prasun Nandy, Jaydeep Sarkar, Joydeep Roy, Arihant Garg, Amit Kumar, Hetal Shah, Arun Rangaraju, Sayantan Chatterjee, Rajesh Kumar Ojha, Dr. Raghav Manohar Narsalay, Praveen Sasidharan, Sundareshwar K (Sundar), Manu Dwivedi, Venkat Nippani, Himadri Ganguly, Ritesh Jain, Abhijit Chakraborty, Sumit Srivastav, Anit Shanker #soyoucan

🚨Incoming: The Federal Zero Trust Data Security Guide Fresh off the presses - In alignment with M-22-09, the Federal CDO Council and Federal CISO Council gathered a cross-agency team of data and security specialists to develop a comprehensive data security guide for Federal agencies. Representatives from over 30 Federal agencies and departments worked together to produce the Federal Zero Trust Data Security Guide, which: 🔹Establishes the vision and core principles for ZT data security 🔹Details methods to locate, identify, and categorize data with clear, actionable criteria 🔹Enhances data protection through targeted security monitoring and control strategies 🔹Equips practitioners with adaptable best practices to align with their agency’s unique mission requirements Securing the data pillar in Zero Trust has been a challenging endeavor, but it’s foundational to a resilient cybersecurity posture. This guide lays out essential principles and a roadmap to embed security at the core of data management beyond traditional perimeters. Here are a few key takeaways: 🔐 Core ZT Principles: Adopting a data-centric approach with strict access controls, data resiliency, and integration of privacy and compliance from day one. 📊 Data Inventory and Classification: It is crucial to understand the data landscape, and the guide provides insights into cataloging and labeling sensitive data for targeted protection. 🤝 Managing Third-Party Risks: From privacy-preserving technologies to detailed vendor assessments, agencies can better secure shared data and protect it from supply chain threats. I had the privilege of attending a couple of these Working Group meetings before leaving CISA earlier this year, and I congratulate the group on this necessary release. This guide aligns closely with CISA's Zero Trust Maturity Model, providing agencies with a robust framework to secure federal data assets and advance a strong, data-centric ZT security model. #data #zerotust #cybersecurity #technology #informationsecurity #computersecurity #datascience #artificialintelligence #digitaltransformation #bigdata 

The CXO’s guide to Quantum Security Customers often tell me that the migration to post-quantum cryptography (PQC) will take them years, and some assets won’t ever be upgraded. While quantum’s long-term threat is clear, security leaders are grappling with the practical, multiyear journey of upgrading potentially thousands of devices, applications and data stores to be quantum-resistant. The “harvest now, decrypt later” threat raises the stakes. Nation-state actors are siphoning and stockpiling encrypted data today, waiting for the arrival of quantum computers to retroactively break it. The implication? Sensitive data may already be in the wrong hands and it’s only a matter of time before it can be put to use. What CXOs need is a clear path forward: Discover - Complete a comprehensive crypto inventory across your environment. You cannot protect what you cannot see. Protect - Achieve post-quantum decryption at scale with NGFW that have crypto-agility built right in, enabling your security as standards evolve.   Accelerate - Leverage segmentation along with emerging new capabilities, like cipher translation, to instantly upgrade legacy devices and applications to secure your data now while your organization upgrades devices and applications.  Read more https://bit.ly/4nVkurw

Stop storing secrets in appsettings.json. Seriously. That file was never meant to hold production credentials, yet I see it in real projects all the time. I just published a new walkthrough where I show how to secure your .NET apps with Azure Key Vault: - Creating your first Key Vault - The exact RBAC roles you actually need - Storing secrets with versioning - Authenticating with DefaultAzureCredential - Pulling secrets directly into ASPNET Core configuration - Loading connection strings + options without touching appsettings It’s a clean setup that keeps your sensitive values out of the repo and follows Azure’s best practices. Learn more here: https://lnkd.in/eU4mUKnY If you want to upgrade how you handle secrets in .NET, this one will help you get it right from the start.

The biggest threat to your data isn’t happening tomorrow. It happened yesterday. If you haven’t heard of HNDL (Harvest Now, Decrypt Later), your long-term data strategy has a massive blind spot. Here is the reality: State actors and cybercriminals are capturing your encrypted data today. They can’t read it yet, so they’re storing it in massive data vaults, waiting for the "Qday"—the moment quantum computers become powerful enough to break current encryption. If your data needs to stay private for 5, 10, or 20 years, it’s already at risk. What’s on the line? ↳ Intellectual Property (IP) and trade secrets. ↳ Government and identity data. ↳ Long-term financial records and contracts. ↳ Sensitive customer health data. How do we solve it? 🛠️ We cannot wait for quantum supremacy to react. The fix starts now: ↳ Inventory: Identify which data has a long shelf-life. ↳ Crypto-Agility: Move toward systems that can swap encryption methods without a total overhaul. ↳ Hybrid PQC: Implement Post-Quantum Cryptography alongside classical methods to ensure traffic captured today remains a mystery tomorrow. The transition to quantum-resistant security is a marathon, not a sprint. Are you tracking HNDL on your current risk register? Let’s discuss in the comments. 👇 P.S. If you want help mapping your exposure or building a PQC migration plan, drop me a message. ♻️ Share this post if it speaks to you, and follow me for more. #QuantumSecurity #PQC

Safeguarding information while enabling collaboration requires methods that respect privacy, ensure accuracy, and sustain trust. Privacy-Enhancing Technologies create conditions where data becomes useful without being exposed, aligning innovation with responsibility. When companies exchange sensitive information, the tension between insight and confidentiality becomes evident. Cryptographic PETs apply advanced encryption that allows data to be analyzed securely, while distributed approaches such as federated learning ensure that knowledge can be shared without revealing raw information. The practical benefits are visible in sectors such as banking, healthcare, supply chains, and retail, where secure sharing strengthens operational efficiency and trust. At the same time, adoption requires balancing privacy, accuracy, performance, and costs, which makes strategic choices essential. A thoughtful approach begins with mapping sensitive data, selecting the appropriate PETs, and aligning them with governance and compliance frameworks. This is where technological innovation meets organizational responsibility, creating the foundation for trusted collaboration. #PrivacyEnhancingTechnologies #DataSharing #DigitalTrust #Cybersecurity

𝗗𝗮𝘁𝗮 𝗗𝗶𝗼𝗱𝗲 𝘃𝘀 𝗨𝗻𝗶𝗱𝗶𝗿𝗲𝗰𝘁𝗶𝗼𝗻𝗮𝗹 𝗚𝗮𝘁𝗲𝘄𝗮𝘆 𝘃𝘀 𝗡𝗲𝘅𝘁-𝗚𝗲𝗻 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹 All three can appear near the IT and OT boundary. But they do not provide the same level of assurance. And they should not be selected just because someone says: “Put something between IT and OT.” 𝗗𝗮𝘁𝗮 𝗗𝗶𝗼𝗱𝗲 This is the strongest option when return traffic must be physically impossible. It provides hardware-enforced one-way communication. Typical use: • OT to IT data export • Historian replication • Logs, alarms and telemetry transfer • Monitoring data from a sensitive zone Think of it as: 𝗢𝗻𝗲-𝘄𝗮𝘆 𝗯𝘆 𝗱𝗲𝘀𝗶𝗴𝗻, 𝗻𝗼𝘁 𝗯𝘆 𝗳𝗶𝗿𝗲𝘄𝗮𝗹𝗹 𝗿𝘂𝗹𝗲 Best when the protected OT zone cannot afford any inbound path back. 𝗨𝗻𝗶𝗱𝗶𝗿𝗲𝗰𝘁𝗶𝗼𝗻𝗮𝗹 𝗚𝗮𝘁𝗲𝘄𝗮𝘆 This uses one-way transfer architecture, usually with additional software services. It may replicate, proxy or transform selected data flows so enterprise applications can still consume OT data. Typical use: • Safer OT data sharing with IT • Historian, file or log replication • Reporting and analytics feeds • Situations where one-way design is needed, but usability also matters Think of it as: 𝗢𝗻𝗲-𝘄𝗮𝘆 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 𝘄𝗶𝘁𝗵 𝗽𝗿𝗼𝘁𝗼𝗰𝗼𝗹 𝘂𝘀𝗮𝗯𝗶𝗹𝗶𝘁𝘆 Best when you need strong isolation, but also need selected business workflows to keep working. 𝗡𝗲𝘅𝘁-𝗚𝗲𝗻 𝗙𝗶𝗿𝗲𝘄𝗮𝗹𝗹 This is the most flexible option. But it is still policy-controlled bidirectional communication. It can inspect traffic, enforce rules, segment zones and apply security policies. Typical use: • Managed communication between IT and OT • Remote access control • Vendor access control • Traffic filtering between zones and conduits • Deep packet inspection and logging Think of it as: 𝗕𝗶𝗱𝗶𝗿𝗲𝗰𝘁𝗶𝗼𝗻𝗮𝗹 𝘁𝗿𝗮𝗳𝗳𝗶𝗰 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝗹𝗲𝗱 𝗯𝘆 𝗽𝗼𝗹𝗶𝗰𝘆 Best when communication needs to flow both ways, but must be tightly governed. 𝗦𝗶𝗺𝗽𝗹𝗲 𝘄𝗮𝘆 𝘁𝗼 𝗿𝗲𝗺𝗲𝗺𝗯𝗲𝗿: • 𝗗𝗮𝘁𝗮 𝗱𝗶𝗼𝗱𝗲 = highest assurance, least flexibility • 𝗨𝗻𝗶𝗱𝗶𝗿𝗲𝗰𝘁𝗶𝗼𝗻𝗮𝗹 𝗴𝗮𝘁𝗲𝘄𝗮𝘆 = strong isolation with better usability • 𝗡𝗲𝘅𝘁-𝗴𝗲𝗻 𝗳𝗶𝗿𝗲𝘄𝗮𝗹𝗹 = highest flexibility, policy-dependent assurance 𝗤𝘂𝗶𝗰𝗸 𝗿𝘂𝗹𝗲 𝗼𝗳 𝘁𝗵𝘂𝗺𝗯: The more flexibility you allow, the more discipline you need in rules, monitoring, change control and ownership. So before choosing the control, ask: 𝗪𝗵𝗮𝘁 𝗰𝗮𝗻 𝘁𝗵𝗶𝘀 𝘇𝗼𝗻𝗲 𝗻𝗼𝘁 𝗮𝗳𝗳𝗼𝗿𝗱 𝘁𝗼 𝗹𝗼𝘀𝗲? If the answer is safety, availability or operational integrity, choose the control based on assurance first, not convenience. ♻️ Reshare to Help Others Learn. 🔔 Follow and press bell to get notified of my posts. 🤝 Subscribe Bi-weekly OT Security Digest Newsletter (7700+) https://lnkd.in/grvyEmZy #OTSecurity #ICSSecurity #DataDiode #UnidirectionalGateway #NextGenFirewall #IndustrialCybersecurity #IEC62443 #NetworkSecurity #CriticalInfrastructure #IndustrialControlSystems