Encrypting Data , Key Exchange , Encryption Technologies , Obfuscation

What is the fundamental difference in purpose between symmetric and asymmetric encryption?

Symmetric encryption uses a single shared key and is designed for fast, high-volume data transmission (e.g., AES). Asymmetric encryption uses a public/private key pair and is used for secure key exchange, identity verification, and digital signatures (e.g., RSA, ECC).

What are the three primary data states in security, and where does encryption protect each?

• Data at Rest: Data stored on media (protected by FDE, file encryption).

• Data in Transit: Data moving across a network (protected by TLS, IPsec).

• Data in Use: Data actively being processed in RAM/CPU memory.

What is the primary purpose of the Diffie-Hellman (DH) or ECDH protocol?

To securely establish a shared secret symmetric key over an untrusted public network without ever transmitting the actual secret key across the wire.

What is Perfect Forward Secrecy (PFS), and how is it achieved?

A property ensuring that if a server's long-term private key is compromised in the future, past recorded session traffic cannot be decrypted. It is achieved by using ephemeral (temporary) keys unique to each session (via DHE or ECDHE).

What is the primary security limitation of Full Disk Encryption (FDE)?

FDE protects data at rest when a device is powered completely down or locked. However, it does not protect data while the device is powered on and unlocked with data sitting decrypted in RAM (Data in Use / memory scraping vulnerabilities).

When should an organization choose Column-level / Field-level encryption over Full Disk Encryption?

When they need granular protection for hyper-sensitive data elements (like credit card numbers or SSNs) inside a database without performance penalties associated with encrypting entire tables or drives.

What is a Hardware Security Module (HSM)?

A specialized, tamper-resistant physical hardware device used to generate, securely store, manage cryptographic keys, and accelerate high-speed crypto operations.

What is Code Obfuscation, and why do malicious actors use it?

Techniques like renaming variables to random characters, fragmenting strings, and flattening control flow to make code intentionally difficult for human analysts to read, thereby evading static signature and malware analysis.

What is Protocol Tunneling in the context of network evasion?

Encapsulating traffic inside a permitted protocol (such as hiding remote-access commands inside authorized HTTPS traffic) to bypass boundary firewalls and Deep Packet Inspection (DPI).