rosoft’s EFS encrypts each file with its own unique symmetric key (even when the entire folder is selected for encryption), which all participating users share. Each user’s individual copy of the unique, but shared, symmetric file key is then encrypted with the user’s unique asymmetric encryption key.
Although file-level encryption products are among the most popular and mature solutions, there is a major weakness that is increasingly making them less desirable. It is difficult to prevent unprotected data leaks with file-level encryption. For instance, suppose you enable file-level encryption on all files within your personal document folder. Although file-level encryption might protect the specific files indicated, it most likely will not protect any temporary files that an application or the operating system creates when the documents are opened, copied, or transmitted. Unless the encryption user accurately knows and protects all the potential areas where the data could be temporarily stored, it is possible for a disk analysis program to find unprotected file remnants.
Several encryption solutions get around the major problem of file-level encryption by encrypting the entire volume or partition on which the file is stored. This can be done at the OS level or using an application. Some volume encryption products work by creating one large logical file that represents the entire encrypted volume. When data is copied to the volume, it is added to the larger encrypted file as a contained element. Other volume encryption products work by adding a custom device driver that interacts with the operating system adding an encryption/decryption routine to the normal file reads and writes. One of the more popular open source volume encryption solutions is TrueCrypt.
The major drawbacks of volume or partition encryption are that a single disk or volume corruption event can make the whole encrypted volume unavailable, or that a single compromise can immediately reveal all protected files. It is also possible for intruders to insert malicious code that intercepts the data between the volume encryption routine and the disk, essentially revealing all data in plain text.
Among the strongest encryption solutions are media-level encryption products; as such, they deserve careful consideration. They can encrypt entire drives -- known as full-drive encryption -- or all data as it is streamed onto a media source (sequential tape backup, for instance). Media-level encryption can be implemented using application software, the operating system, or hardware. Even hard-drive vendors such as Seagate Technologies are getting into the action (see “Scouting for Encryption Solutions,” page 34).
An informal list of full-disc encryption products can be found here.
A database that needs protection typically requires field-level encryption. It can be encrypted on a per-column or per-row basis, but it’s usually preferable to encrypt data per element. Essentially all the data stored in a database table is encrypted before being stored in the database and is then decrypted on the fly. This presents additional challenges for indexing and queries, and for that reason, those mechanisms have to be privy to the field-level encryption routines used to store the data.
There aren’t many field-level encryption products that can be used across disparate databases or programs. Most solutions are database- or application-specific, or they require customized programming. Microsoft, IBM, Oracle, Sybase, and other popular database vendors all offer field-level encryption solutions.
Protecting data in motion
It’s essential to protect data as it traverses nonsecure networks. The Web has fixated on the SSL/TLS standard. Network transmissions and VPNs are often protected using SSL, SSH, or IPSec. E-mail can be protected using asymmetric cryptography with PGP or S/MIME. Increasingly, other forms of network communications, such as peer-to-peer and IM traffic, must be authenticated and encrypted.
Holistic solutions come into play when data must be protected across multiple platfo