Encryption & Security in System Architecture

Encryption & Security Foundations In modern distributed systems, data must be protected both while it is moving across the network ( in transit ) and while it is stored on physical disks ( at rest ). Effective security relies on the mathematical transformation of data to ensure only authorized parties can read or verify it. 1. Secure Web Transit: HTTPS HTTPS (Hypertext Transfer Protocol Secure) is the standard for secure web communication. It provides three critical layers of protection: Encryption: Scrambles data so eavesdroppers cannot read it. Data Integrity: Detects if data was altered during transmission (e.g., man-in-the-middle attacks). Authentication: Verifies that the client is actually talking to the intended server, not an impostor. HTTPS achieves this by wrapping standard HTTP traffic inside an SSL/TLS (Secure Sockets Layer / Transport Layer Security) tunnel. 2. Protecting Data: Encryption Encryption is the process of converting "plaintext" (readable data) into "ciphertext" (unreadable, scrambled data) using a secret key. A. Symmetric Encryption Uses the same key for both encryption and decryption. Usage: Encrypting large files or data at rest (e.g., hard drive encryption like AES-256). Strength: Extremely fast. Weakness: The main challenge is securely sharing the key between the sender and receiver. B. Asymmetric (Public-Key) Encryption Uses a pair of keys : a Public Key (shared with everyone) and a Private Key (kept secret by the owner). Usage: Establishing secure connections (like the initial TLS handshake in HTTPS) and digital signatures. Mechanism: If you encrypt data with the Public Key, only the holder of the matching Private Key can decrypt it. 3. Verification: Hashing Unlike encryption, hashing is a one-way function . It takes an input of any size and produces a fixed-length string (the "hash"). Irreversibility: You cannot "decrypt" a hash back into its original input. Determinism: The same input will always produce the exact same hash. Usage: Password Storage: Servers never store passwords; they store the hash of the password. When a user logs in, the server hashes the input and compares it to the stored hash. Data Integrity: Checking if a file has been tampered with (comparing the file's hash before and after transfer). 4. The Modern Perimeter: Zero Trust Architecture Traditional security models relied on the "castle-and-moat" approach: everything inside the corporate network was trusted, and everything outside was untrusted. In distributed, cloud-native environments, this is no longer sufficient. Zero Trust Architecture operates on a simple, ruthless principle: "Never trust, always verify." Core Zero Trust Pillars Identity-Centric: Access is granted based on the user's verified identity, not the network location they are connecting from. Least Privilege: Users and services are given only the absolute minimum permissions necessary to complete their task. Micro-segmentation: The network is broken into tiny, isolated zones. If an attacker breaches one microservice, they cannot move laterally (horizontally) to access other services. Continuous Verification: Trust is not a one-time login. Every single request between microservices—even inside your own data center—must be authenticated, authorized, and encrypted. Encryption & Security Reference Matrix Concept Primary Function Reversible? Primary Production Use Case HTTPS Secure transit Yes (decryptable) Securing web traffic (TLS tunnel). Encryption Protect data confidentiality Yes (requires key) Storing sensitive data (PII, databases). Hashing Protect data integrity / verify input No Storing passwords, checksums. Zero Trust System-wide security policy N/A Distributed microservice security.