Encryption & Data Protection

Symmetric vs Asymmetric Encryption

Encryption questions on 220-1202 hinge on one idea: symmetric is fast but has a key-distribution problem; asymmetric solves distribution but is slow. Real systems combine both.

Symmetric (one shared key)

• The same key encrypts and decrypts.
• Fast enough for bulk data (full-disk, Wi-Fi, VPN payloads).
• Weakness: both sides must already share the key secretly.

Asymmetric (key pair)

• A public key and a mathematically linked private key.
• Anyone encrypts with your public key; only your private key decrypts.
• Slow, so it is used for key exchange and digital signatures, not bulk data.

How HTTPS Actually Works (Hybrid)

1. Client connects to the server on port 443.
2. Server presents its digital certificate containing its public key.
3. Client validates the cert against a trusted Certificate Authority (CA) chain.
4. Both sides use asymmetric crypto to agree on a one-time symmetric session key.
5. All page data flows under fast symmetric AES.

Why hybrid: asymmetric solves the secret-sharing problem at the start, then symmetric handles the heavy lifting because asymmetric encryption of every packet would be far too slow. Hashing (SHA-256) is separate again — it verifies integrity and stores passwords, and is one-way (no decryption).

---

Data Protection States

A laptop stolen from a car illustrates all three: full-disk encryption protects the drive at rest, a VPN would have protected anything it sent in transit, and screen-lock plus least privilege guard data in use.

---

Windows Encryption Tools

BitLocker — Full-Disk Encryption

• Encrypts entire volumes with AES-128 or AES-256.
• Prefers a TPM chip to seal the key to the hardware; without TPM it requires a startup USB key or boot PIN.
• Available only in Windows Pro and Enterprise, not Home.
• BitLocker To Go encrypts removable USB drives.
• Save the recovery key to a Microsoft account, AD/Entra, USB, or print — losing it locks you out permanently.

EFS — Encrypting File System

• Encrypts individual files/folders, not whole drives.
• Tied to the user's certificate; transparent while that user is logged in.
• Also Pro/Enterprise only; if the user profile/certificate is lost without backup, files are unrecoverable.

BitLocker vs EFS: BitLocker defends against physical theft of the whole drive; EFS defends against another user on the same machine opening your files. macOS uses FileVault for full-disk encryption.

---

Certificates and PKI

Browser Certificate Warnings

• Expired — past its validity date.
• Self-signed — not from a trusted CA (common internally).
• Name/domain mismatch — cert name differs from the URL.
• Revoked — invalidated for compromise.

Rule: never click through a certificate warning on a public website. It can mean an impostor site or an on-path attacker. Proceed only on an internal host where you trust a known self-signed certificate.

---

Hashing vs Encryption, and Mobile Encryption

The exam routinely contrasts hashing with encryption, and confusing the two costs points. Encryption is reversible with a key; hashing is a one-way fingerprint with no key and no way back. Hashes (MD5 is broken; SHA-256 is current) verify that a downloaded file was not altered and store passwords so the plaintext is never kept. A salt adds random data to each password before hashing so identical passwords produce different hashes, defeating precomputed rainbow tables.

A quick decision guide:

• Need to read the data back later? Use encryption (AES for bulk, RSA/ECC for key exchange).
• Need only to verify integrity or store a password? Use a salted hash.
• Need to prove who sent something? Use a digital signature — the sender hashes the message and encrypts the hash with their private key; anyone verifies it with the public key. This provides integrity and non-repudiation at once.

Mobile and Removable Media

Modern phones encrypt storage by default once a screen lock is set, and full-device encryption is mandatory on managed devices through Mobile Device Management (MDM). For removable drives, BitLocker To Go on Windows and hardware-encrypted USB keys protect data if the stick is lost. A remote wipe through MDM destroys data on a stolen device.

Exam scenario: an executive's encrypted laptop is stolen but powered off. Because the volume was encrypted at rest with BitLocker and the recovery key was escrowed in Active Directory, the data is unreadable to the thief and recoverable by IT — the textbook payoff of encrypting data at rest. The lesson the exam reinforces is that encryption only helps if it is enabled BEFORE the loss and the recovery key is safely backed up.