CompTIA SecurityX (CAS-005)Security EngineeringMedium
A security architect is designing a new cloud-native application that will process highly sensitive customer financial data. The application uses microservices, and each service needs to encrypt its data at rest before storing it in a database. To minimize the risk associated with key compromise and ensure compliance, a multi-layered encryption strategy is required, where data encryption keys (DEKs) are themselves encrypted. Which cryptographic technique BEST describes this approach?
- AHomomorphic Encryption
- BSecure Multi-Party Computation (SMPC)
- CEnvelope Encryption
- DQuantum Key Distribution (QKD)
Show answer & explanationAnswer & explanation
Correct answer: C. Envelope Encryption
Envelope encryption is a multi-layered encryption strategy where data is encrypted with a data encryption key (DEK), and the DEK itself is then encrypted with a key encryption key (KEK). This approach enhances security by protecting the keys that protect the data, often leveraging a Key Management System (KMS) for KEKs.
Why the other options are wrong
- A. Homomorphic encryption allows computations on encrypted data without decrypting it, which is not the primary goal here.
- B. Secure Multi-Party Computation allows multiple parties to jointly compute a function over their inputs while keeping those inputs private, which is unrelated to the described encryption strategy.
- D. Quantum Key Distribution is a method for securely exchanging cryptographic keys using quantum mechanics, not a data encryption strategy.
Envelope Encryption
A cryptographic technique where data is encrypted with a data encryption key (DEK), and the DEK itself is then encrypted with a key encryption key (KEK).
- Multi-layered encryption
- DEK encrypts data, KEK encrypts DEK
- Enhances key management and security
Memory trick: An envelope protects your letter, and envelope encryption protects your key better!