Read the data at each encryption layer

short · 55 min · Objective 3.4

Task

Encrypt the same data at three layers and demonstrate, at each, exactly who can still read it -- which is the selection rule the objective rests on.

Steps

  1. Store the dataset with full-disk or volume encryption only. While the system is running, read the sensitive field as a normal user and capture it in lab/layer-disk.txt.
  2. Add database-level transparent encryption. Read the field through a query and capture it in lab/layer-db.txt -- it will still be readable, which is the lesson.
  3. Encrypt the field itself, with the key held by the application and not by the database. Query it directly and capture the CIPHERTEXT in lab/layer-field.txt.
  4. Read it correctly through the application and confirm the plaintext returns.
  5. Write lab/layer-note.md stating, for each layer, which adversary is excluded and which is not, and name the layer required to exclude the database administrator.

Verify

grep -c . lab/layer-disk.txt lab/layer-db.txt
grep -Eqi '[A-Za-z0-9+/]{24,}={0,2}' lab/layer-field.txt && echo "field layer returns ciphertext"
grep -Eci 'administrator|dba|above|excluded' lab/layer-note.md

Plaintext readable at the first two layers, ciphertext at the third, and the note naming field-level as the layer that excludes the database administrator. Transparent database encryption is the layer most often deployed and most often believed to do more than it does.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.