Encryption
Encryption
What is encryption?
- Converting data so it can't be read without a key
- Protecting data in transit and at rest
- Stolen, but unreadable
Adding encryption is not about bolting on one more technology. It changes the 'severity' of an incident when one happens. Even if a server is breached and the entire member table walks out, AES-256 ciphertext leaves the attacker with meaningless strings. If it is plaintext, breach-notification and reporting obligations kick in from that moment and the support center is paralyzed for days. That is why, in practice, encryption is not 'a way to stop hacking' but a safeguard that caps the damage in advance, for the moment after a breach. Firewalls and access control do the blocking; encryption covers what happens after they fail.
Encryption falls into three broad types. Symmetric-key encryption (AES-256) locks and unlocks with a single key, so it is fast and suits large volumes of stored data such as database columns, files, and backups. Asymmetric-key encryption (RSA, elliptic curve) locks with a public key and unlocks with a private key. It is slower, so it is used for key exchange and digital signatures. HTTPS uses asymmetric keys at connection time to exchange a symmetric key, then handles the actual traffic with the symmetric key. The third is hashing: bcrypt and Argon2 cannot be decrypted at all, so strictly speaking they are not encryption, and they are used only for values like passwords where the original never needs to be known. Masking (e.g., Hong ○○) or tokenization is often reported as encryption, but that only changes how data is displayed, and the original stays intact.
Key management is where practice most often goes wrong. The report says everything is locked with AES-256, yet the key is hard-coded in the source and pushed to GitHub, or sits in a folder on the same server as the encrypted DB. That is like putting the lockbox and its key in one envelope, and audits flag it every time. Relying on disk encryption alone is also risky: while the server is running the data is decrypted, so it does nothing once an admin account is taken over. Storing passwords as unsalted SHA-256 is still common too. A single GPU can try billions of guesses per second, so common passwords are effectively plaintext. Backup files, logs, and Excel files downloaded by staff are mostly left outside the scope of encryption.
Jaryong KooMarketing PhD and leading authority on AI, data analytics, and personal branding
Seungtae ParkAX practitioner who builds AI business development and marketing automation tools and teaches from that hands-on experienceCiphers have existed since ancient times. Modern computer encryption was standardized from the mid-20th century alongside advances in mathematics and information theory, and became the foundation of internet security.
Consider a hypothetical case: Company A, an online food shop with 38 employees and annual revenue of about KRW 12 billion (≈ US$8,978,000). After signing up 240,000 members, it began partnership talks with a major retailer and went through the retailer’s security due diligence. Within two days, the review found four critical issues in “password storage and encryption key custody,” and the partnership contract was put on hold for three months.
- The development team lead opened the code and was the first to raise a hand. "The passwords of our 240,000 members are unsalted SHA-256. A laptop can crack the 10,000 most common ones in a few minutes."
- The CTO switched to bcrypt (cost 12) but chose to rehash at login rather than change everything in one batch. It ran alongside the old hashes for four months, and the switch went through with no forced logouts.
- The security manager switched the national ID number and bank account columns to AES-256 and moved the keys hard-coded in the source into a KMS. "If the key and the data sit on the same server, it’s as good as unlocked" was the takeaway from that day’s meeting.
- The assistant manager in charge of infrastructure shut off TLS 1.0 and 1.1 connections and allowed only 1.2 and above. Member spreadsheets that operators used to download from the admin screen now go out only as password-protected archives, and every download is logged.
- Six months later, the re-audit showed critical findings down from 4 to 0 and total findings down from 7 to 1. Login response time rose by 40ms on average with no change in bounce rate, and the partnership contract that had been on hold was signed that same month.