Encrypting Your Data
By: Sam Bell
Tags: Cybersecurity, Encryption, Python, Data Science, Security

Encrypting Your Data

Unlock the Lock

American whistle-blower Edward Snowden, and former National Security Agency (NSA) Director Michael Hayden have said that America is more secure and safer with “unbreakable end to end encryption.” Snowden continues that “I can promise you … one thing: If I am standing shoulder to shoulder with the director of the National Security Agency on something, there’s a damn good reason for that.”

Anyone working with data has a responsibility to make sure that sensitive data is not at-risk from being stolen. Too often the implemented cybersecurity policies are followed as a check list of bare minimums, and this as it turns out, isn’t enough. In 2018 T-Mobile, Quora, Facebook, and 18 other major companies succumbed to data breaches. Unfortunately, data ethics and data security are often overlooked. Take this post as a quick tutorial on encrypting your own data, and please further educate yourself on how to properly implement encryption on database systems.

Insert hologram of padlock

The idea of encryption is simple: data can be scrambled by a sender with an encryption key, and then unlocked by the receiver with a decryption key. Symmetric encryption means that the encryption key and decryption key are the same. This is the less effective method as the delivery of the key could be intercepted digitally. Asymmetric encryption means that the encryption key and decryption key differ. Asymmetric encryption, or public-key encryption, is accomplished with the use of a public key and a private key. The private key is used to decrypt the data.

Good encryption keys should be no smaller than 2048 bits. Keys larger than this are rarely used because of the significant computational burden; however, a key this size is good enough as it would take a normal computer 14 billions years to crack a 2048-bit certificate, and nobody has got time for that.

Sweet Brown

Mr. Therriault noted that there is no excuse not to encrypt your data. It is on your device, and therefore it is your responsibility to encrypt the data you use, especially if you are working with sensitive data. I currently have a database with my friend’s names, social security numbers, and a list of their worst fears. If anyone got this information, it could spell danger!

Let’s walk through the steps of how best to encrypt this pandas data frame using a symmetric key system. The encryption process is simplified in the model below.

Symmetric Encryption

Before we begin we will need to install the Python cryptography module. The documentation for this module can be found here. The hazardous materials layer has my interest piqued. Also, check out their open source project!

C.R.E.A.M.

I want to encrypt my very sensitive data, so I am going to save it as a file first — a CSV file.

Import the cryptography module and create a new key. Every time you run this code, a new key will be printed. The key is a bytes object of a Base64 encoder string.

We need to save a key so that we are able to actually use it to encrypt. To save the key we can write it into a file. The code below will save it in a file within the folder you are working in currently.

If you want to retrieve the key, we can retrieve the key from the file we saved with read bytes.

If you want to create a new encryption key with a password, you can do that too. With this method a new encryption key will be created for every new password used. You need to create a salt, which is easily done using the OS module.

We can copy and paste that output and assign it as salt in the code below.

With all of these parameters just so we can simply change the password_provided and we will be assigned a new key. Each unique password will have a unique key.

With our key in hand we can now encrypt and decrypt a file, or even a string! With the code below you can encrypt a file.

The file looks like this now:

Encrypted!

To decrypt we can simply switch a file name, and a few commands shown below:

Now you should have three files. The original file, an encrypted version of that file, and a decrypted version of that file. As long as you have the key, you may delete the original file and only keep the encrypted version. Proper key management is critical to the effectiveness of encryption. Keys should always be kept in a separate and secure place. You shouldn’t keep your encryption keys within a file or in the same folder. This would be the same as keeping your key to your front door underneath your doormat.

You can even encrypt your encryption key! This is known as a Key Encryption Key (KEK), which should be isolated from the data it unlocks. The best practice would involve securing your KEKs with a Master Encryption Key and a Master Signing Key. Using different keys for different parts of data is also a good practice. This may be difficult because it requires the user to know which key to fetch every time the data is encrypted or decrypted. It is possible to decrease your chances of getting hacked by following proper encryption protocol, but unfortunately the majority of programmers do the bare minimum when it comes to data security. Too many developers follow a checklist mandated by guidelines like HIPAA or company policy, but these guidelines are usually not enough for a proper defense against data breaches. Here are some common encryption mistakes that you should avoid.

With great power comes great responsibility, and if you are working with sensitive data on your computer it is your responsibility to protect that data. Educating yourself on the details of encryption and the best methods of implementation should prevent a data breach from happening to you. Practice encrypting your files because you never know who could be looking.