What Is Data Encryption? Data at Rest, Data in Transit, Data in Use and Key Management

Data encryption is the operation of converting sensitive or critical data into an unintelligible form using mathematical algorithms in order to prevent it being read by unauthorized people. Data encryption, used in English as Encryption, is one of the most fundamental protection layers inside modern Data Security Architecture. However, encryption is not only "locking" the data. An effective encryption architecture handles together which data will be encrypted, which algorithm will be used, where the keys will be kept, who can access these keys and how the key lifecycle will be managed.

In modern organizations data is located in three fundamental states: Data at Rest, Data in Transit and Data in Use. Each of these three states gives rise to different risks and different encryption needs. Data standing on a disk and data carried over the network are not protected with the same methods. In the same way protecting the data actively processed by an application is a separate security problem.

For this reason the fundamental question on the subject of data encryption is not only:

"Is the data encrypted?"

this.

The real questions are these:

Which data is encrypted?

Which algorithm is being used?

Who has the key?

How is the key protected?

What happens if the key is taken over?

At which stage is the data decrypted?

How does the application or the user access the decrypted data?

Without these questions being answered saying only "we use encryption" is not sufficient in terms of real data security.

What Is Data Encryption?

Data encryption is data in the open state, that is plaintext data, being converted into an unreadable form, that is into ciphertext, using a cryptographic algorithm and an encryption key.

As a result of this conversion even if the attacker takes over the data it becomes difficult for them to make sense of the content without the correct key.

For example a database backup may have been taken over by an attacker.

If the backup is not encrypted the customer records can be read directly.

However, if the backup has been encrypted with a strong encryption algorithm and the key is protected separately the attacker only taking over the file will not be sufficient.

For this reason encryption is a critical control especially in order to reduce the data exposure impact.

Why Is Encryption Important?

In modern organizations it may not always be possible to prevent the data being taken over completely.

A laptop can be stolen.

A backup disk can be lost.

Cloud storage can be exposed by mistake.

Network traffic can be intercepted.

A database copy can be obtained by an unauthorized person.

In these situations encryption acts as the second line of defense.

That is, even if the attacker accesses the storage or the file they cannot read the data directly.

For this reason encryption is an important component of the defense-in-depth approach.

Is Encryption Sufficient on Its Own?

No.

This is one of the most critical points.

If the attacker takes over a legitimate user account the application can already show the data by decrypting it.

For example the database can be encrypted.

However, if the attacker takes over the authorized application credential the data can be read over the application.

For this reason encryption:

Identity Security

Access Control

DLP

Monitoring

must be used together with these.

Encryption protects the data but does not solve the authorization problem.

What Are Plaintext and Ciphertext?

Plaintext is the readable state of the data.

For example:

Customer Name: Ahmet Yılmaz

is plaintext.

The data after encryption:

8fa7c2a91...

can turn into a meaningless ciphertext such as this.

The decryption operation converts the ciphertext back into plaintext with the correct key.

This process is the foundation of encryption.

What Is an Encryption Key?

An Encryption Key is the secret value the cryptographic algorithm uses to encrypt or decrypt the data.

In a way the security of the encryption depends on the security of the key.

Using a strong algorithm and storing the key in a place everyone can access is a serious security mistake.

For this reason this principle is important:

"Encrypted Data and the Encryption Key must not be kept uncontrolled in the same security domain."

What Is Symmetric Encryption?

Symmetric Encryption is the model where the same key is used for encryption and decryption.

One of the most common symmetric algorithms is AES.

Symmetric encryption is fast and is suitable for encrypting a large amount of data.

For this reason:

disk encryption,

database encryption,

backup encryption

it is used frequently in areas such as these.

However, the biggest problem is key distribution.

Because the sender and the receiver must share the same secret key in a secure way.

What Is AES?

AES, that is the Advanced Encryption Standard, is today one of the most widely used symmetric encryption standards.

AES can be used with different key sizes:

AES-128

AES-192

AES-256

In corporate data protection use cases the expression AES-256 is seen frequently.

However, looking only at the key size is not sufficient.

The algorithm mode, the implementation quality and the key management also affect the security.

What Is Asymmetric Encryption?

Asymmetric Encryption uses two different keys:

Public Key

and:

Private Key

The Public Key can be shared.

The Private Key is kept secret.

Many security protocols benefit from this model.

For example data encrypted with the public key can be decrypted only with the corresponding private key.

Asymmetric cryptography especially in:

digital certificates,

secure key exchange,

digital signatures

is important in areas such as these.

The Difference Between Symmetric and Asymmetric Encryption

Symmetric encryption is fast and is suitable for large data.

Asymmetric encryption has more computational cost but is strong for key exchange and identity verification.

Modern protocols generally use the two together.

For example while a TLS connection is being established a secure session is created with asymmetric cryptography.

Afterwards the actual data transfer can be done with symmetric encryption.

This is the hybrid cryptography approach.

Is Hashing Encryption?

No.

Hashing and encryption are not the same thing.

Encryption is reversible.

With the correct key the data can be resolved back.

Hashing, on the other hand, is ideally a one-way process.

For example a hash can be used for password storage.

The original password is not decrypted directly.

This distinction is important.

The Difference Between Encryption and Hashing

Encryption:

Confidentiality

focuses on providing this.

Hashing:

Integrity / Verification

can be used for purposes such as these.

For example if the file hash changes it can be understood that the file has been changed.

Password hashing, on the other hand, is used in the authentication context.

For this reason in the security architecture the two techniques solve different problems.

What Is Data at Rest?

Data at Rest is data standing on storage.

For example:

Hard Disk

SSD

Database

Backup

Object Storage

USB Drive

Tape

enter the Data at Rest scope.

This data is at risk in the case of a physical or logical storage compromise.

Why Is Data at Rest Encryption Necessary?

When a laptop is stolen if the disk is not encrypted the attacker can access the files by connecting the storage to another system.

In a similar way a backup disk or a database file can be taken over.

Data at Rest Encryption reduces this risk.

For this reason full disk encryption and database encryption are critical controls.

What Is Full Disk Encryption?

Full Disk Encryption ensures that all the data on the disk is kept encrypted.

When the user device is opened after authentication the disk can be used decrypted.

It is very important in terms of laptop security.

If the device is stolen the storage cannot be read offline.

This is valuable especially for remote work environments.

What Is File-Level Encryption?

File-Level Encryption applies encryption on certain files or folders.

While full disk encryption protects all the storage file-level encryption provides more granular protection.

For example only Confidential documents can be encrypted.

This can be integrated with classification-aware data protection.

What Is Database Encryption?

Database Encryption ensures that the sensitive data inside the database is encrypted.

It can be applied at different levels:

Database-Level

Table-Level

Column-Level

Field-Level

Application-Level

Every approach creates different security and performance trade-offs.

What Is Transparent Data Encryption – TDE?

Transparent Data Encryption ensures that the database files are kept encrypted on the storage.

The application can generally access the data without a code change.

The database engine decrypts the data in a transparent way.

TDE reduces especially the stolen database file or storage media risk.

However, it does not prevent the data access of an authenticated database user.

This is a very important distinction.

What Does TDE Protect, What Can It Not Protect?

TDE:

database files,

backup files,

storage theft

can provide protection in scenarios such as these.

However, if the attacker has obtained a valid database credential they can see decrypted data by running a normal query.

For this reason TDE:

Access Control

DAM

PAM

must be used together with these.

Column-Level Encryption

Column-Level Encryption applies encryption to certain sensitive columns.

For example:

Credit Card Number

Identity Number

Health Data

can be kept encrypted.

This provides more granular protection.

However, the application integration can be more complex.

Application-Level Encryption

Application-Level Encryption is the data being made encrypted by the application before being sent to the database.

The database sees only the ciphertext.

This can limit database administrators seeing plaintext data.

However, the key management responsibility passes to the application side.

This architecture must be designed carefully.

Field-Level Encryption

Field-Level Encryption applies encryption on certain application fields.

For example:

SSN

Credit Card

Passport Number

critical fields such as these can be kept encrypted.

This can be a strong approach in terms of sensitive data minimization.

Why Is Backup Encryption Critical?

Backup systems keep large copies of the production data.

For this reason they are a high-value target for an attacker.

If the backup is not encrypted a single backup file can create millions of records of exposure.

For this reason backup encryption must be an inseparable part of the Data Security programme.

Are Immutable Backup and Encryption the Same Thing?

No.

Immutability ensures that the backup cannot be changed or deleted.

Encryption, on the other hand, prevents the content being read in an unauthorized way.

The two are different controls.

The strongest backup security:

Encryption + Immutability + Access Control + Isolation

is the combination of these.

Cloud Storage Encryption

Cloud storage services can generally provide encryption capabilities.

However, the organization must know these questions:

Is the data encrypted?

Who manages the key?

Is it a provider-managed key?

Is it a customer-managed key?

How is key rotation carried out?

These questions are important in terms of the shared responsibility model.

What Is Data in Transit?

Data in Transit is data carried over the network from one system to another.

For example:

Browser → Web Server

Application → Database

API → API

User → Cloud Service

enter the Data in Transit scope.

This data is open to the network interception risk.

How Is Data in Transit Protected?

The most common method is TLS.

The data passing over the TLS connection becomes encrypted.

Thanks to this even if the attacker captures the network traffic they cannot read the content directly.

This has critical importance especially for public internet communications.

What Is TLS?

TLS, that is Transport Layer Security, is the protocol family that makes network communications encrypted and authenticated.

HTTPS is actually HTTP working over TLS.

TLS can provide server identity verification besides confidentiality.

This is carried out over certificates.

Are SSL and TLS the Same Thing?

Although the expression SSL is still used in daily use for modern secure communications TLS is taken as the basis.

SSL expresses the old protocol family.

For this reason in modern security language:

TLS

using this is more correct.

What Does a TLS Certificate Do?

A certificate helps to verify the identity of the server.

The client:

"Am I really talking to the correct server?"

looks for an answer to this question.

A certificate signed by a Trusted Certificate Authority supports this trust relationship.

What Is Mutual TLS – mTLS?

In standard TLS the client generally verifies the server identity.

In Mutual TLS the server verifies the client certificate too.

This provides strong authentication for machine-to-machine communications.

Especially in:

APIs

Microservices

Service Mesh

it can be used in these environments.

API Encryption

If sensitive data is being carried over APIs TLS must be compulsory.

However, encryption protects only the transport.

The API response authorization again requires separate control.

Using HTTPS does not solve the broken authorization problem.

For this reason:

Encryption + API Security

are necessary together.

Is TLS Necessary on the Internal Network?

Yes.

"The internal network is safe."

this assumption is not compatible with the modern Zero Trust approach.

The attacker may have entered the internal network.

For this reason east-west traffic must also be encrypted.

TLS is valuable especially for sensitive service-to-service traffic.

What Is Data in Use?

Data in Use is the situation where it is actively processed by an application or a user.

This is one of the most difficult areas of encryption.

Because the CPU generally needs the data in plaintext form in order to process it.

For this reason data at rest and transit encryption may not be sufficient.

How Is Data in Use Protected?

Data in Use protection can be provided with different methods:

Access Control

Memory Protection

Data Masking

Tokenization

Trusted Execution Environments

Confidential Computing

approaches such as these can be used.

This area continues to develop.

What Is Confidential Computing?

Confidential Computing is the security approach that aims for the data to be kept inside a protected execution environment during processing.

Concepts such as a Trusted Execution Environment or a secure enclave can be used.

The aim is to limit even the cloud provider or the privileged infrastructure layer accessing the data directly.

This is valuable especially for highly sensitive workloads.

What Is a Trusted Execution Environment – TEE?

A TEE is the architecture that creates an isolated execution area inside the processor.

Code and data can run inside protected memory.

This can be used for data in use protection.

However, the implementation and the threat model must be evaluated carefully.

Is Data Masking Encryption?

No.

Masking hides the real data from the user.

For example:

**** **** **** 1234

such as this.

This is not encryption.

Masking reduces exposure at the presentation layer.

What Is Static Data Masking?

Static Data Masking is the sensitive values being permanently changed while a copy is being created.

For example before the production database is copied to the test environment the customer names and card numbers are changed with synthetic values.

This is important for test environments.

What Is Dynamic Data Masking?

Dynamic Data Masking shows the data masked according to the authorization level of the user in the query result.

The original data does not change in the database.

For example a privileged user sees the full value.

A standard user sees the masked value.

This works together with access control.

What Is Tokenization?

Tokenization is a meaningless token being used in place of the sensitive value.

For example the actual card number:

4444...

instead of this:

tok_8d72...

is used.

The real value can be kept in a secure token vault.

This can reduce sensitive data exposure.

The Difference Between Tokenization and Encryption

Encryption is mathematically reversible.

Tokenization, on the other hand, can be mapping-based.

The token itself may not carry direct information about the original value.

Tokenization provides an important advantage especially in use cases such as payment processing.

What Is Key Management?

The most critical component of encryption is key management.

Key Management is the lifecycle that manages cryptographic keys being:

Generate

Store

Distribute

Use

Rotate

Revoke

Archive

Destroy

done to them.

Strong encryption can become meaningless with bad key management.

What Is the Key Lifecycle?

An encryption key must not be used forever.

The lifecycle generally:

Key Generation

Activation

Usage

Rotation

Revocation

Retirement

Destruction

consists of these stages.

This process must be managed with a policy.

Key Generation Security

Keys must be created with strong random number generators.

Predictable or manually created keys must not be used.

Cryptographic strength depends on the key generation quality.

For this reason trusted cryptographic modules can be preferred.

Where Must Key Storage Be?

Keys must not be stored inside plaintext config files.

For example:

database_password.txt

or:

encryption_key="123456"

configurations such as these are a serious security risk.

Keys must be stored inside a secure vault or a KMS.

What Is a KMS?

A KMS, that is a Key Management Service/System, enables cryptographic keys to be managed centrally.

A KMS can provide these capabilities:

Key Generation

Key Storage

Access Control

Rotation

Audit

Revocation

This provides centralized governance.

What Is an HSM?

An HSM, that is a Hardware Security Module, is the specialized device or service that protects cryptographic keys inside a hardware-backed secure environment.

Private keys may not come outside the HSM as plaintext as much as possible.

For this reason it is important for high-security environments.

The Difference Between a KMS and an HSM

A KMS provides key lifecycle management.

An HSM, on the other hand, ensures that the keys are kept under hardware-level security.

A KMS can use an HSM as a backend.

For this reason the two concepts are not competitors but complementary.

What Is Key Rotation?

Key Rotation is the existing encryption key being changed with a new key at certain intervals.

The aim is to limit the key exposure impact.

If a key is used for years in the case of a compromise the data can be at risk for a long period.

The rotation policy must be determined according to the data sensitivity.

How Often Must Key Rotation Be Carried Out?

There is no single universal period.

The risk, the regulation, the application architecture and the data sensitivity must be taken into account.

High-risk keys can be rotated more frequently.

The most important point is the rotation being operationally possible.

Manual and complex rotation processes are most of the time not applied.

For this reason automation is important.

What Is Key Revocation?

When a key compromise is suspected the use of the key must be stopped.

This is revocation.

However, if the encrypted data is still protected with the old key re-encryption can be required.

For this reason a key compromise scenario must be present in the incident response plan.

Key Destruction

In order to make the data cryptographically inaccessible key destruction can be used.

If the key that decrypts the only copy of the encrypted data is destroyed in a secure way the data can practically become inaccessible.

This approach can be thought of as crypto-shredding.

What Is Key Escrow?

Key Escrow is the encryption key being kept in a secure third-party or controlled repository for recovery purposes.

This can provide operational continuity.

However, the escrow location becomes a high-value attack target.

For this reason strong controls are required.

Why Is Separation of Duties Important in Key Management?

A single administrator must not have unrestricted access to both the encrypted data and the encryption key.

This is the Separation of Duties principle.

For example the storage admin manages the data.

The key admin manages the KMS.

Both accesses are not given to a single role.

This reduces insider risk.

What Is Dual Control?

For critical key operations the approval of two different authorized people can be required.

For example a Master Key export operation can require dual control.

This reduces the single-person abuse risk.

What Is a Master Key?

A Master Key can be a higher-level key that protects the other keys.

For this reason its compromise impact is very high.

For master keys:

HSM

Strict Access

Audit

Rotation

have critical importance.

What Is Envelope Encryption?

Envelope Encryption is the model of the actual data being encrypted with a Data Encryption Key and this key being protected with another Key Encryption Key.

This provides scalable key management.

It is a common pattern in cloud encryption architectures.

What Is a Data Encryption Key – DEK?

A DEK is the key that encrypts the actual data.

It is used for a large data volume.

A DEK can be protected with another higher-level key.

This separation makes key management easier.

What Is a Key Encryption Key – KEK?

A KEK is the higher-level key used to encrypt Data Encryption Keys.

DEK → protects the data.

KEK → protects the DEK.

This is layered cryptographic architecture.

What Is a Customer-Managed Key?

In the Customer-Managed Key model the organization has more control over the key lifecycle.

The cloud provider can provide the infrastructure but the key policies are managed by the customer.

This can be preferred for compliance or sensitive workloads.

What Is a Provider-Managed Key?

In the Provider-Managed Key model the cloud provider manages the key management process largely automatically.

It provides operational simplicity.

However, the customer control level can be lower.

It must be evaluated according to the use case.

What Is BYOK?

BYOK, that is Bring Your Own Key, expresses the organization using the encryption key it has created itself inside a cloud or SaaS service.

This provides more key ownership.

However, the operational responsibility also increases.

What Is HYOK?

HYOK, that is Hold Your Own Key, is the more restrictive approach that aims for the encryption key to be kept in customer-controlled infrastructure outside the provider environment.

This can be evaluated for high security requirements.

However, there are availability and usability trade-offs.

The Difference Between BYOK and HYOK

In BYOK the customer creates the key but the key can be imported into the provider infrastructure.

In HYOK the key continues to be kept in the customer control domain.

HYOK can provide higher control but the architecture is more complex.

External Key Management

Some organizations can want to use an external KMS for cloud services.

This can be preferred because of provider compromise or control concerns.

However, the connectivity and availability dependency must be designed carefully.

Why Is Key Availability Important?

If the encryption key becomes inaccessible the data can become inaccessible too.

For this reason key availability is as important as key security.

Key management systems must be designed with high availability and disaster recovery.

Must Key Backup Be Carried Out?

For critical keys a secure backup can be required.

However, backup keys must be protected very strictly.

If the key backup is compromised the encryption protection weakens.

For this reason backup keys must also be under HSM-level or equivalent protection.

Key Audit Logging

Every critical key operation must be logged.

For example:

Who accessed key?

Who rotated?

Who disabled?

Who exported?

This provides accountability.

KMS logs can be transferred to the SIEM.

KMS Integration with the SIEM

Unusual key usage can show a security incident.

For example:

Normally unused key suddenly accessed

or:

Mass decrypt operation

can create an alert.

The SIEM can correlate this event with identity and endpoint telemetry.

Encryption Integration with PAM

Key administrators are privileged users.

For this reason KMS or HSM administrative access can be managed over PAM.

Session recording and JIT access can be applied.

This strengthens cryptographic governance.

The Relationship Between Encryption and DLP

Encryption makes the data unreadable.

DLP, on the other hand, controls the data movement.

For example an encrypted confidential file can be taken outside.

If the attacker cannot access the key the risk decreases.

However, if the legitimate recipient can decrypt it a DLP policy is again necessary.

For this reason the two controls are complementary.

Encryption with Data Classification

Data Classification can determine which data needs which encryption level.

For example:

Public → Standard Platform Encryption

Internal → Encryption at Rest

Confidential → Encryption at Rest + Transit

Restricted → Strong Encryption + Customer-Managed Key + Strict Access

a model such as this can be created.

This is risk-based encryption.

Classification-Aware Encryption

When a sensitive label is applied encryption can come into play automatically.

For example if a document is classified as Confidential:

Encryption Enabled

External Sharing Restricted

Print Limited

can be these.

This converts the classification into technical enforcement.

Encryption with Data Discovery

Data Discovery finds in which repositories there is sensitive data.

Then:

Is it encrypted?

this question can be asked.

Thanks to this:

Sensitive + Unencrypted

findings can be prioritized.

DSPM can carry out this analysis with a wider context.

DSPM and Encryption Posture

DSPM can create this finding:

Restricted Data

No Encryption

Public Access

=

Critical Risk

This risk scoring makes the data security posture visible.

Encryption and Zero Trust

Zero Trust data security wants the data to remain under protection even if access is granted.

Encryption narrows the trust boundary.

Even if the storage or the network is compromised data confidentiality can be preserved.

For this reason encryption is an important technical layer of Zero Trust architecture.

What Is Certificate Management?

TLS certificates also require lifecycle management.

Certificates can expire.

The private key can be compromised.

For this reason a certificate inventory is important.

Expired certificates can create a service outage.

Compromised certificates, on the other hand, can increase the MITM risk.

What Is PKI?

PKI, that is Public Key Infrastructure, is the infrastructure that manages digital certificates and public/private key relationships.

PKI:

Identity

Authentication

Encryption

Digital Signature

can support these use cases.

It can be a fundamental security infrastructure for enterprise environments.

What Is a Certificate Authority – CA?

A CA is the trusted authority that issues certificates.

Internal organizations can also use their own private CA.

This is important especially for internal systems and mTLS.

Private Key Security

A TLS certificate can be public.

However, the corresponding private key must be kept secret.

If the private key is compromised the attacker can carry out server identity impersonation.

For this reason private keys must be protected inside a secure store or an HSM.

Are an Encryption Key and a Password the Same Thing?

No.

A password is used for user authentication.

An encryption key is used for cryptographic operations.

Keys must generally have much higher entropy.

Human-memorable encryption keys are a bad security practice.

What Is Secrets Management?

Secrets Management:

Passwords

API Keys

Tokens

Certificates

Encryption Keys

provides the secure management of sensitive credentials such as these.

While a KMS focuses on encryption keys secrets management covers a wider non-human credentials set.

These concepts can be used together.

Why Is Storing a Key Inside the Source Code Risky?

If a developer hardcodes the encryption key into the source code everyone who has repository access can see the key.

If the repository becomes public the key can leak.

For this reason keys must be managed over environment variables or secret managers.

However, environment variables are also not secure storage on their own.

Secret Scanning

Source code repositories must be under secret scanning.

Accidentally committed:

API Keys

Private Keys

Passwords

must be detected.

If a key leak takes place only deleting the commit is not enough.

The key must be revoked and rotated.

Encryption and DevSecOps

Inside the modern application security pipeline:

Secret Scanning

Certificate Validation

TLS Configuration Check

Cryptographic Library Analysis

can be added.

Source Code Analysis can also detect weak cryptographic implementations.

What Is Weak Cryptography?

Old or weak cryptographic algorithms are a security risk.

Legacy systems can use outdated hashing or encryption algorithms.

For this reason a cryptographic inventory must be carried out.

Which applications use which algorithms must be known.

What Is a Cryptographic Inventory?

A Cryptographic Inventory is the list of the:

Algorithms

Keys

Certificates

Libraries

Protocols

used inside the organization.

This is gaining importance especially in terms of crypto migration and post-quantum readiness.

What Is Crypto-Agility?

Crypto-Agility is the organization's ability to pass to the new standard quickly and in a controlled way when the cryptographic algorithms or keys change.

For example if the algorithm used is no longer accepted as secure the organization must be able to change it.

Hardcoded cryptography makes crypto-agility difficult.

Why Is Crypto-Agility Important?

Cryptographic standards can change over time.

An algorithm accepted as secure today can weaken in the future.

New compliance requirements can appear.

Quantum computing developments can require new cryptographic transitions.

For this reason the architecture must be algorithm-independent and flexible as much as possible.

What Is Post-Quantum Cryptography?

Post-Quantum Cryptography is the area of cryptographic algorithms intended to be resistant against future quantum computers.

This subject has gained importance especially for long-term sensitive data.

Every organization does not have to change all the systems immediately.

However, cryptographic inventory and crypto-agility preparation are important.

The Harvest Now, Decrypt Later Risk

An attacker can capture encrypted traffic today and target decrypting it in the future with strong computing capability.

This can create a risk especially for data that must remain confidential for long years.

For this reason long-term secrecy requirements must be evaluated inside the cryptographic strategy.

Encryption and AI Systems

AI environments also require sensitive data encryption.

For example:

Training Data

Prompt Logs

Vector Databases

Model Artifacts

Agent Memory

must be kept encrypted.

AI applications creating new data repositories is widening the encryption scope.

Vector Database Encryption

RAG systems can use vector databases.

Embeddings may not be an exact copy of the original text but can be related to sensitive information.

For this reason vector stores:

At Rest Encryption

TLS

Access Control

must be protected with these.

Prompt Log Encryption

Prompt logs can contain confidential content entered by users.

These logs must be kept encrypted on the storage.

In addition retention and access controls must be applied.

Encryption does not solve the privacy problem on its own but reduces the exposure risk.

AI Agent Credentials Encryption

AI Agents can use API credentials or service tokens.

These secrets must not be kept inside the source code or plain config.

A secrets manager or a vault must be used.

The agent runtime must access the credential only at the moment of need.

AI Agents and Key Access

An AI Agent must not receive direct broad access to the encryption key.

The agent must have limited access only for the required cryptographic operation.

For example:

Decrypt Customer Field

if it has this authorization the entire KMS administration permission must not be given.

This is the Least Privilege for Cryptography approach.

RAG and Encrypted Documents

If a RAG system is going to work on encrypted documents the decryption authorization must be designed correctly.

A document the user does not have access permission to must not be decrypted and retrieved by the model.

For this reason:

Encryption

Permission-Aware Retrieval

must work together.

What Is Client-Side Encryption?

Client-Side Encryption is the data being made encrypted on the client side before being sent to the cloud service.

The provider sees the ciphertext.

This can provide higher privacy.

However, search, indexing and collaboration capabilities can be limited.

This trade-off must be evaluated carefully.

What Is Server-Side Encryption?

Server-Side Encryption is applied by the provider or the server during data storage.

It is operationally easy.

However, when the server is authorized it can access the plaintext.

According to the threat model it can be sufficient or insufficient.

What Is End-to-End Encryption?

End-to-End Encryption targets the data not being seen as plaintext by intermediary systems from the sender device to the recipient device.

It is strong in terms of communication privacy.

However, it can create a trade-off with enterprise monitoring, DLP and compliance use cases.

Do DLP and End-to-End Encryption Contradict?

Sometimes.

DLP inspection can be carried out before the data is encrypted on the endpoint.

However, an intermediary network DLP cannot see the encrypted content.

For this reason E2EE environments increase the importance of endpoint security.

The Performance Effect of Encryption

Encryption can create computational overhead.

Modern hardware has reduced this overhead considerably.

However, for large-scale databases or high-throughput systems performance testing must be carried out.

Security design must be carried out together with performance considerations.

The Balance Between Encryption and Availability

Overly complex key management can create an availability risk.

If the key becomes inaccessible a critical application may not work.

For this reason Data Security must protect not only confidentiality but availability too.

A KMS outage scenario must be planned.

Disaster Recovery and Key Management

The DR site can have a backup of the data.

However, if the encryption keys are not in the DR environment the restored data cannot be used.

For this reason DR planning must cover key recovery too.

This is a frequently forgotten point.

Cross-Region Key Strategy

For multi-region cloud architectures in which regions the keys will be used must be planned.

There can be regulatory or data residency considerations.

Key replication must be evaluated in terms of security and availability.

How Is an Encryption Policy Created?

A corporate Encryption Policy must answer these questions:

Which data will be encrypted?

Is at rest encryption required?

What is the TLS minimum standard?

Which algorithms are approved?

By whom will the keys be managed?

What is the rotation policy?

How will backup keys be protected?

What will be done if a key is compromised?

This policy is the foundation of cryptographic governance.

Matching the Encryption Policy with Data Classification

An example model:

Public

Standard infrastructure protection.

Internal

Encryption at Rest + TLS.

Confidential

Mandatory Encryption + Controlled Keys.

Restricted

Strong Encryption + Dedicated KMS/HSM + Strict Key Access + Detailed Audit.

This is only an example model.

The organization must create its own risk model.

What Is an Encryption Baseline?

An Encryption Baseline determines the minimum cryptographic requirements for all systems.

For example:

TLS required

Disk encryption required on laptops

Backup encryption required

Weak protocols prohibited

This provides consistency.

Cryptographic Standardization

If different teams use different algorithms governance becomes difficult.

Security-approved cryptographic libraries and standards can be determined.

Developers must not write their own cryptography implementation.

Trusted libraries must be used.

Why Is "Do Not Roll Your Own Crypto" Important?

A cryptography implementation is extremely sensitive.

A small mistake can create a serious vulnerability.

For this reason a custom algorithm or home-made encryption must not be used.

Well-reviewed standards and libraries must be preferred.

Encryption Monitoring

The encryption configuration must not be done once and forgotten.

Security teams must detect these situations:

Unencrypted Storage

Expired Certificates

Weak TLS

Disabled Encryption

Unused Keys

Old Algorithms

This requires continuous posture management.

DSPM and Cryptographic Posture

DSPM can relate the sensitive data findings with the encryption status.

For example:

Confidential Data + Unencrypted Storage

can create a finding.

This provides data-centric remediation priority.

CSPM and Encryption

CSPM can check the encryption configurations on cloud resources.

For example storage encryption disabled.

DSPM, on the other hand, analyzes the data sensitivity inside the same storage.

The two together evaluate the risk more accurately.

Encryption Key Compromise Incident Response

A key compromise must be handled as a security incident.

An example response flow:

Detect

↓

Disable Key

↓

Identify Affected Data

↓

Rotate / Replace Key

↓

Re-encrypt Data

↓

Investigate Access Logs

↓

Assess Data Exposure

↓

Update Controls

This playbook must be prepared beforehand.

How Can a Key Compromise Be Detected?

The indicators:

Unusual KMS access

Unauthorized key export

Abnormal decryption volume

Unknown administrator activity

can be signals such as these.

KMS logs must be transferred to the SIEM.

Mass Decryption Detection

An attacker can decrypt large data with a compromised service account.

For this reason unusual decrypt activity analytics can be carried out.

For example if an identity that normally does 100 operations/day suddenly makes 1 million decrypt requests an investigation can be required.

Encryption and Insider Threat

Key administrators can carry a big risk.

For this reason the insider threat programme must cover cryptographic administrators too.

PAM, dual control and audit are important here.

Encryption and Compliance

Many security and privacy frameworks handle encryption as an important technical safeguard for sensitive data.

However, using encryption does not mean compliance on its own.

Key management, access control and operational procedures are important too.

Data Encryption in Terms of KVKK

Within the scope of the protection of personal data encryption can be one of the appropriate technical measures.

It can reduce the risk especially for portable media, backups, endpoints and network transmissions.

However, encryption does not meet the data security obligations on its own.

Access governance, logging, monitoring and incident response are also necessary.

Encryption Checklist

• Is a sensitive data inventory present?
• Have the encryption requirements been matched with Data Classification?
• Is Data at Rest encryption being applied?
• Is there Full Disk Encryption on laptops?
• Are the server disks encrypted?
• Is database encryption present?
• Has granular encryption been evaluated for sensitive columns?
• Are the backups encrypted?
• Is cloud storage encryption active?
• Is TLS being used for Data in Transit?
• Has internal traffic encryption been evaluated?
• Do the APIs use TLS?
• Is mTLS being used in the necessary service flows?
• Are weak cryptographic protocols disabled?
• Are the approved algorithms defined?
• Is custom cryptography forbidden?
• Is a Key Management Policy present?
• Are the keys kept outside the source code?
• Is a central KMS being used?
• Is an HSM being used in the necessary areas?
• Is Key Rotation defined?
• Is there a Key Revocation process?
• Is the key backup secure?
• Are the master keys under special protection?
• Is Separation of Duties being applied?
• Is Dual Control present in the necessary operations?
• Is key usage being logged?
• Are KMS logs being transferred to the SIEM?
• Are the key administrators under PAM?
• Have the BYOK/HYOK needs been evaluated?
• Is a certificate inventory present?
• Is certificate expiry monitoring being carried out?
• Are the private keys being kept securely?
• Is Secrets Management being applied?
• Is source code secret scanning present?
• Has a cryptographic inventory been prepared?
• Is there a Crypto-Agility plan?
• Is legacy cryptography being detected?
• Are the AI data stores encrypted?
• Are the vector databases under encryption?
• Are the prompt logs being protected?
• Are the AI Agent secrets inside a vault?
• Is there key recovery in the DR plan?
• Is a key compromise incident playbook present?

Data Encryption Maturity Model

Level 1 – Basic or Scattered Encryption: Some systems are encrypted, some are not. Key management is mostly manual or application-specific.

Level 2 – Standardized Encryption: Corporate standards are created for disk, database, backup and network encryption. TLS and Full Disk Encryption are made widespread.

Level 3 – Centralized Key Management: A KMS/HSM is used, key rotation and audit processes are centralized. The encryption requirements are matched with the classification.

Level 4 – Risk-Based Cryptographic Governance: DSPM/CSPM findings, identity risk and data sensitivity are evaluated together with the encryption posture. Secrets, certificates and the cryptographic inventory are managed centrally.

Level 5 – Crypto-Agile Data Security: Encryption policies are applied automatically for human, machine and AI workloads. Algorithm migration, post-quantum transition and adaptive key controls are integrated into the corporate security architecture.

This transformation:

Basic Encryption

↓

Standardized Protection

↓

Centralized Key Management

↓

Risk-Aware Cryptography

↓

Crypto-Agile Data Security

proceeds in this way.

Frequently Asked Questions

What is data encryption?

Data encryption is readable data being converted into a form that cannot be understood by unauthorized people using a cryptographic algorithm and a key.

What is encryption?

Encryption is the operation of confidentiality being provided by converting plaintext data into ciphertext.

What is Data at Rest?

It is data stored on a disk, a database, a backup or storage.

What is Data in Transit?

It is data carried over the network from one system to another.

What is Data in Use?

It is data actively processed by an application or a user.

What is AES?

AES is a widely used symmetric encryption standard and can be used to encrypt a large amount of data.

What is TLS?

TLS is the Transport Layer Security protocol family that makes network communications encrypted and authenticated.

What is TDE?

Transparent Data Encryption is the database encryption approach that ensures that the database files are kept encrypted on the storage.

What is a KMS?

A KMS is the Key Management System/Service approach that centrally manages the creation, storage, rotation, access control and audit processes of encryption keys.

What is an HSM?

A Hardware Security Module is the specialized security system that protects cryptographic keys inside a hardware-backed secure environment.

What is the difference between a KMS and an HSM?

A KMS manages the key lifecycle, an HSM protects the key material under hardware security. They can be used together.

What is Key Rotation?

Key Rotation is the cryptographic key being changed with a new key at certain intervals.

What is BYOK?

Bring Your Own Key is the organization using the encryption key it has created itself on a cloud or SaaS platform.

What is HYOK?

Hold Your Own Key is the key control model where the encryption key is kept in customer-controlled infrastructure outside the provider environment.

What is the difference between Tokenization and Encryption?

Encryption is mathematically reversible. Tokenization changes the sensitive value with a token over a separate secure mapping.

Is Data Masking encryption?

No. Data Masking hides the real value from the user but is not cryptographic encryption.

What does Full Disk Encryption do?

Even if the laptop or the disk is physically taken over it makes it difficult for the data on the storage to be read offline.

Does encryption prevent data leakage completely?

No. If an authorized account is taken over the application can access the decrypted data. Encryption must be used together with IAM, DLP, Access Control and Monitoring.

What is Crypto-Agility?

Crypto-Agility is the organization's ability to pass to the new standard quickly and in a controlled way when the cryptographic algorithms, protocols or keys used change.

Is encryption necessary in AI systems?

Yes. Training datasets, vector databases, prompt logs, agent memory and AI credentials can contain sensitive data and must be protected with appropriate encryption controls.

Conclusion: Strong Encryption Is Not Strong Without Strong Key Management

In the world of data security encryption is one of the strongest technical controls.

However, only using an algorithm is not sufficient.

The real security of encryption:

Data Classification

Cryptographic Algorithm

Key Management

Identity

Access Control

Monitoring

consists of the combination of these.

A database can be encrypted with AES.

However, if the encryption key is located as plaintext on the same server the protection weakens.

A backup can be encrypted.

However, if the key is kept in the same location as the backup the risk continues.

TLS can be used.

However, if the certificate private key has been compromised the communication security can be affected.

For this reason a modern encryption programme must answer not only:

"Is it encrypted?"

this question but:

"How is it encrypted, with which key, who has the key, when was it rotated, who used it and what will we do when it is compromised?"

these questions.

Data at Rest,

Data in Transit,

Data in Use

are not the same security problem.

Every data state needs its own controls.

For At Rest:

Disk Encryption

Database Encryption

Backup Encryption.

For In Transit:

TLS

mTLS

Secure API Communication.

For In Use:

Access Control

Masking

Tokenization

Confidential Computing.

At the centre of all of these, on the other hand, is Key Management.

Because the weakest point of encryption is most of the time not the algorithm but the key.

Cloud, SaaS and AI adoption is enlarging this problem even more.

Now keys are managed not only for servers but for:

Cloud workloads,

APIs,

Microservices,

AI Agents,

RAG systems,

Vector databases

these too.

For this reason the approach of the future will be not only Encryption Management but Cryptographic Governance.

And the most important sentence of this chapter:

Modern data encryption is not only making the data unreadable; it is applying the correct cryptographic controls throughout Data at Rest, Data in Transit and Data in Use, managing the encryption keys in a secure way and making all the decryption operations carried out by a human, an application or an AI Agent controlled and traceable.