Data encryption encodes information so only authorized parties can read it. The data becomes unreadable ciphertext without the correct key. Encryption protects data at rest on disks and databases. It protects data in transit over networks. It protects data in use in some advanced implementations. The goal is simple: if someone steals the data, they cannot use it.

Encryption is not a complete security strategy. It protects confidentiality, not availability. Ransomware can still encrypt your data and demand payment, even if your own encryption is strong. It does not protect against insider threats who have legitimate access and the keys. It does not protect against application flaws that leak data through other channels. Key management is the hard part. Keys stored in plaintext next to the encrypted data defeat the purpose. Keys shared across systems increase the blast radius of a compromise. Hardware security modules and key management services exist to solve this problem. They are expensive and complex. Many organizations skip them and store keys in configuration files. That works until someone finds the file. Encryption is a tool. Like any tool, its value depends on how it is used.

Encryption contexts

• At rest — disks, databases, backups
• In transit — TLS, VPNs, encrypted messaging
• In use — homomorphic encryption, secure enclaves
• End-to-end — only sender and receiver can read

Encryption without key management is theater. The algorithm is strong. The key storage is the weak point.