Encryption Fundamentals

Learning Path

📘 Phase 1 – Overview

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand why encryption is essential for cloud security.
Explain the difference between encryption, hashing, encoding and digital signatures.
Understand symmetric and asymmetric encryption.
Learn how encryption protects data at rest and in transit.
Understand encryption key management.
Explore AWS encryption services and best practices.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Beginner

Prerequisites: Networking Fundamentals

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Every organisation stores sensitive information.

Examples include:

Customer records
Banking information
Healthcare records
Intellectual Property
Source Code
API Keys
Passwords
Financial Reports

If attackers gain access to this information, encryption ensures that the data remains unreadable without the appropriate decryption key.

Encryption is one of the most important controls for protecting confidentiality and meeting compliance requirements.

🌍 What is Encryption?

Encryption is the process of converting readable information (Plaintext) into unreadable information (Ciphertext) using a mathematical algorithm and a cryptographic key.

Only authorised users with the correct key can decrypt and read the information.

Plaintext
      │
      ▼
Encryption Algorithm + Key
      │
      ▼
Ciphertext
      │
      ▼
Decryption Key
      │
      ▼
Original Plaintext

🔒 Why Encryption Matters

Encryption protects data when:

A laptop is stolen.
A storage device is lost.
A cloud storage bucket is exposed.
Network traffic is intercepted.
Backups are compromised.
Databases are copied.

Without encryption, attackers can immediately read sensitive information.

🔐 Types of Encryption

Symmetric Encryption

Symmetric encryption uses one key for both encryption and decryption.

Plaintext
     │
     ▼
Shared Secret Key
     │
     ▼
Ciphertext
     │
     ▼
Same Secret Key
     │
     ▼
Plaintext

Advantages

Fast
Efficient
Suitable for large amounts of data

Challenges

Secure key distribution
Shared secret must remain protected

Examples:

AES-128
AES-192
AES-256

AWS primarily uses AES-256 for encryption at rest.

Asymmetric Encryption

Asymmetric encryption uses two keys.

Public Key
Private Key

Public Key
      │
Encrypt Data
      │
Ciphertext
      │
Decrypt
      ▼
Private Key

Advantages

Secure communication
Digital signatures
Certificate-based authentication

Challenges

Slower than symmetric encryption

Examples:

🔑 Symmetric vs Asymmetric Encryption

Feature	Symmetric	Asymmetric
Keys Used	One	Two
Speed	Fast	Slower
Best For	Data Storage	Secure Communication
Examples	AES	RSA, ECC

🔐 Data at Rest

Data at Rest refers to stored information.

Examples:

Amazon S3
Amazon EBS
Amazon RDS
Amazon DynamoDB
Backup Files

Encryption protects stored data even if storage media are compromised.

AWS services commonly support encryption using AWS Key Management Service (KMS).

🌐 Data in Transit

Data in Transit refers to information moving across networks.

Examples:

Browser → Website
EC2 → Database
API → Application
AWS Service → AWS Service

Encryption protects data from interception during transmission.

Common technologies include:

HTTPS
TLS
VPN
SSH

🔑 Encryption Keys

Encryption depends on secure key management.

Poor key management can render strong encryption ineffective.

Best practices include:

Rotate keys regularly.
Restrict key access.
Monitor key usage.
Store keys securely.
Avoid embedding keys in application code.

☁️ AWS Key Management Service (AWS KMS)

AWS KMS simplifies encryption key management.

Features include:

Customer Managed Keys (CMKs)
AWS Managed Keys
Automatic Rotation
Fine-grained IAM Permissions
CloudTrail Integration
Hardware Security Module (HSM) support

AWS KMS integrates with:

S3
EBS
RDS
Lambda
Secrets Manager
EFS
DynamoDB

🔒 Hashing

Hashing is not encryption.

Hashing converts data into a fixed-length value.

Password
      │
Hash Function
      │
Hash Value

Characteristics:

One-way process
Cannot be reversed
Used for integrity verification

Common algorithms:

SHA-256
SHA-512

Applications:

Password storage
File integrity
Digital signatures

📦 Encoding vs Encryption vs Hashing

Feature	Encoding	Encryption	Hashing
Reversible	Yes	Yes	No
Purpose	Data Representation	Confidentiality	Integrity
Requires Key	No	Yes	No
Example	Base64	AES	SHA-256

Understanding the difference is essential for selecting the correct security control.

✍️ Digital Signatures

Digital signatures verify:

Authenticity
Integrity
Non-repudiation

Process:

Document
      │
Hash
      │
Encrypt Hash
      │
Private Key
      │
Digital Signature

Recipients verify the signature using the sender’s public key.

Digital signatures confirm that data has not been altered and that it originated from the expected sender.

🏢 Enterprise Scenario

CloudNova Technologies

CloudNova Technologies stores customer records in Amazon S3.

Security review findings:

S3 encryption is disabled.
Database backups are unencrypted.
API traffic uses HTTP instead of HTTPS.
Developers store API keys in source code.
Encryption keys never rotate.

As the Cloud Security Engineer:

Identify the security risks.
Explain the business impact.
Recommend AWS encryption services.
Prioritise remediation tasks.

🧪 Hands-on Exercise 1 — Explore AWS KMS

Objective

Understand AWS Key Management Service.

Steps

Sign in to AWS Management Console.
Navigate to AWS Key Management Service (KMS).
Explore:
- Customer Managed Keys
- AWS Managed Keys
- Aliases
- Key Policies

Questions:

What is the purpose of AWS KMS?
What is the difference between AWS Managed Keys and Customer Managed Keys?

🧪 Hands-on Exercise 2 — Verify HTTPS

Visit:

https://aws.amazon.com

Click the padlock icon.

Review:

Certificate
Encryption Algorithm
Validity Period
Certificate Authority

Questions:

Why is HTTPS important?
What happens if HTTPS is not used?

🧪 Hands-on Exercise 3 — Generate SHA-256 Hash

Windows PowerShell

Get-FileHash .\sample.txt -Algorithm SHA256

Linux/macOS

sha256sum sample.txt

Modify the file and calculate the hash again.

Questions:

Did the hash change?
Why is hashing useful for integrity verification?

🧪 Hands-on Exercise 4 — Base64 Encoding

Linux/macOS

echo "GoHackersCloud" | base64

Windows PowerShell

[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("GoHackersCloud"))

Now decode it.

Linux/macOS

echo "R29IYWNrZXJzQ2xvdWQ=" | base64 --decode

Windows PowerShell

[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("R29IYWNrZXJzQ2xvdWQ="))

Questions:

Was Base64 encrypted?
Why should Base64 never be used to protect sensitive information?

🧪 Hands-on Exercise 5 — Identify Encryption Usage

For each scenario below, determine the appropriate security control.

Scenario	Encryption	Hashing	Digital Signature
Store customer data	✅	❌	❌
Verify software download	❌	✅	✅
Secure HTTPS website	✅	❌	✅
Store passwords	❌	✅	❌
Verify sender identity	❌	❌	✅

Discuss your reasoning.

📊 Knowledge Check

Answer the following questions:

What is encryption?
What is ciphertext?
What is the difference between symmetric and asymmetric encryption?
What is data at rest?
What is data in transit?
What is AWS KMS?
What is hashing?
What is the difference between encoding and encryption?
What is a digital signature?
Why is key management important?

📝 Assignment

Prepare an Enterprise Encryption Strategy Report for CloudNova Technologies.

Include:

Why encryption is important.
Symmetric vs asymmetric encryption.
Data at rest vs data in transit.
Hashing vs encryption.
Digital signatures.
AWS KMS overview.
Recommendations for securing customer data and encryption keys.

Length: 2–3 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

Encryption protects sensitive information from unauthorised access.
Symmetric encryption is fast and suitable for protecting stored data.
Asymmetric encryption enables secure communication and digital signatures.
Hashing verifies integrity but does not provide confidentiality.
Data should be protected both at rest and in transit.
Effective key management is just as important as the encryption algorithm itself.
AWS KMS simplifies enterprise encryption and key management across AWS services.

📚 Further Reading

AWS Key Management Service (KMS) Documentation
AWS Encryption SDK
AWS Secrets Manager Documentation
NIST SP 800-57 – Recommendation for Key Management
NIST SP 800-175B – Cryptographic Mechanisms

🚀 Next Lesson

➡️ Risk Management