What is encryption? Protecting data confidentiality

Encryption transforms readable data into ciphertext using algorithms and keys so only holders of the right key can read it again. Encrypt in transit (TLS) and at rest (disks, databases, backups). It is a cybersecurity pillar and part of personal-information duties (Law 25, PIPEDA).

In one sentence

Encryption makes data unreadable without the right key—in transit and at rest.

Key points

Symmetric (one key) vs asymmetric (public/private pair).
TLS protects transit; KMS/disks protect rest.
Key management is as critical as the algorithm.
Encrypt ≠ authenticate: combine with access control.

Term at a glance

Encryption: Chiffrement · Cryptography · Encryption at rest / in transit
English term: Encryption
Domain: Cybersecurity
Category: Cryptography
Level: Beginner to intermediate

What does “encryption” mean exactly?

Without encryption, a network intercept or stolen disk exposes plaintext. NIST standards guide recommended algorithms (AES, etc.).

Application-level (field) encryption is sometimes added for highly sensitive data.

For an SME, TLS everywhere, encrypted disks, and encrypted backups cover the essentials.

How do you implement encryption correctly?

01
Inventory sensitive data
Personal info, secrets, payments.
02
Encrypt transit
Up-to-date HTTPS/TLS, HSTS, managed certs.
03
Encrypt rest
Volumes, DB, backups; keys in a KMS.
04
Govern keys
Rotation, least privilege, access logging.

Concrete encryption example

A digital clinic in Quebec enforces HTTPS, encrypts the patient DB at rest via cloud KMS, and stores encrypted offsite backups. A stolen laptop does not yield plaintext records.

What is encryption for?

Sites and APIs

TLS for sessions and forms.

Cloud storage

Encrypted buckets and disks.

Messaging / files

End-to-end or at-rest protection.

Compliance

Meet Law 25 / PIPEDA expectations.

Pros and cons of encryption

Confidentiality even if media leaks
Client and partner trust
De facto modern web requirement
Complements access controls

Key-management complexity
Lost key = lost data
Minor perf to size
Does not replace authN/authZ

Encryption vs hashing?

	Encryption	Hashing
Reversible	Yes with the key	No (one-way)
Typical use	Data confidentiality	Passwords, integrity
Key	Needed to decrypt	No decryption
Example	AES, TLS	bcrypt, SHA-256 (by use)

Why encryption matters for a Quebec SME

A breach without encryption can trigger individual notice, reputational harm, and fines. Well-managed encryption reduces residual impact—and reassures insurers and clients.

FAQ

Is HTTPS enough?

Necessary but not sufficient: also cover rest and backups.

Which algorithm?

Follow NIST/OWASP; avoid home-grown crypto.

Does DB encryption slow things?

Often negligible on modern hardware; measure.

Where do keys live?

Out of code: KMS/HSM, secrets managers.

Sources and references

Want a quick check of TLS, at-rest encryption, and key management? We can audit.

Talk about encryption

Glossary