Encryption: The Last Line of Defense
Encryption protects data confidentiality even when other controls fail. If an attacker gains access to encrypted data without the key, the data remains protected.
Encryption at Rest
Database Encryption
Transparent Data Encryption (TDE):-- PostgreSQL
ALTER SYSTEM SET ssl = 'on';
-- Enable pgcrypto for column-level encryption
CREATE EXTENSION pgcrypto;
UPDATE users SET ssn = pgp_sym_encrypt(ssn, 'encryption_key');
Application-Level Encryption: Encrypt before storing. This provides protection even from database administrators:
from cryptography.fernet import Fernet
key = Fernet.generate_key()
cipher = Fernet(key)
encrypted = cipher.encrypt(b"sensitive data")
File System Encryption
- LUKS (Linux): Full disk encryption for Linux systems
- BitLocker (Windows): Volume-level encryption with TPM integration
- dm-crypt: Block device encryption
Cloud Storage Encryption
- AWS: SSE-S3, SSE-KMS, SSE-C (server-side encryption options)
- Azure: Azure Storage Service Encryption with customer-managed keys
- GCP: Default encryption + Customer-Managed Encryption Keys (CMEK)
Encryption in Transit
TLS 1.3
The latest TLS version with significant security improvements:- Reduced handshake latency (0-RTT and 1-RTT)
- Removed insecure cipher suites
- Forward secrecy mandatory
- Encrypted handshake messages
Certificate Configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
ssl_prefer_server_ciphers on;
ssl_session_timeout 1d;
ssl_session_tickets off;
Key Management
Principles
- Separation of duties: Key administrators cannot access encrypted data
- Key rotation: Regular rotation with defined schedules
- Key hierarchy: Master keys protect data encryption keys
- HSM storage: Hardware Security Modules for master keys
Cloud KMS
All major providers offer managed key management:- Automatic key rotation
- Fine-grained access policies
- Audit logging of key usage
- HSM-backed key storage
Where SuperClue Fits
SuperClue does not audit data stores for encryption at rest. Its DAST scanner checks encryption in transit for the sites you scan: TLS versions, cipher suites, forward secrecy, and certificates.