Chapter 19 — Encryption in practice
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 Device encryption"]
N2["19.2 Data in transit"]
N3["19.3 Certificates"]
N4["19.4 Keys and recovery"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 Device encryption"]
N2["19.2 Data in transit"]
N3["19.3 Certificates"]
N4["19.4 Keys and recovery"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 Device encryption]
|
v
[19.2 Data in transit]
|
v
[19.3 Certificates]
|
v
[19.4 Keys and recovery]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) enable encryption for devices and data; (2) manage certificates for websites; (3) handle keys and recovery.
19.1 Device encryption
Jamal enables full-disk encryption on Riverbend laptops and checks it on desktops. He stores recovery keys in the device management system, so IT can recover a laptop if its owner forgets a password, but nobody else can read the disk. When a laptop is stolen from a car, the IT manager confirms it was encrypted and disables the user's accounts. No member data are exposed. He records the theft and the confirmation of encryption in the incident log. Ms. Grant uses the case in class as an example of how encryption limits harm.
19.2 Data in transit
Jamal checks that the booking website and staff webmail use encrypted connections with current protocol versions. He finds an internal reporting page served without encryption on the staff network. Though internal, it shows member names. He asks the IT manager to add encryption. Ms. Grant notes that internal networks are not automatically safe, especially when guest or supplier devices could reach them. The IT manager installs a certificate on the reporting page within a week, and Jamal confirms that the page now loads only over an encrypted connection.
19.3 Certificates
Websites use certificates to prove their identity. Riverbend's public website certificate expired last year, causing browser warnings that frightened members. Jamal lists all certificates with expiry dates and owners and sets up automatic renewal where possible. For certificates that cannot renew automatically, he sets reminders thirty days before expiry. He learns that certificate management is a routine task that causes outages when forgotten. The list contains eleven certificates. Two are due to expire within a month, and the IT manager renews them immediately while the automatic process is set up.
19.4 Keys and recovery
Encryption depends on keys. Jamal learns that losing keys can make data unrecoverable, while exposing them makes encryption useless. He checks that backup encryption keys are stored separately from backups and that two people know how to retrieve them. Ms. Grant explains that key management is the hard part of encryption, and that recovery should be tested before it is needed. He tests key retrieval with the IT manager, timing how long it takes to recover a backup encryption key from its separate store and restore a test file with it.
Worked example
Jamal enables laptop encryption with escrowed recovery keys, adds encryption to an internal page showing member names, sets up certificate renewal and checks key storage.
Synthetic case. Devices are synthetic.
Errors and limits
Losing encryption keys can make data unrecoverable.
Exercises
- EX055 — Stolen laptop. Why were no data exposed from the stolen laptop? Rubric: 3 = it was encrypted;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX056 — Internal page. What did the unencrypted internal page show? Rubric: 3 = member names;; 2 = partly correct;; 1 = other;; 0 = none.
- EX057 — Renewal reminder. When are manual renewal reminders set? Rubric: 3 = thirty days before expiry;; 2 = partly correct;; 1 = wrong;; 0 = none.
Continue studying — lesson 19 (chapter 19 of 30)
← Chapter 18 · Course chapter index · Chapter 20 →
Continue to the next authored lesson.