Many strategies can be employed to prevent attackers from penetrating a system. These include intrusion detection systems, VPNs, firewalls, and more. While these measures are crucial for defending against external threats and controlling access to a network, they fall short in safeguarding data from internal threats and more sophisticated attacks. Such defenses often fail to protect the data once an intruder has bypassed the initial barriers. Furthermore, with the advent of the cloud, the concept of “network perimeter” has become increasingly blurry. This is where data protection becomes indispensable. As data breaches are both costly and highly damaging to a company’s reputation, it is essential to go beyond the traditional approach of network-perimeter security. 

Protecting sensitive data with cryptography therefore appears as an obvious choice, but there remains the question of where to apply encryption exactly. Indeed, cryptography can be integrated into an existing system in a variety of ways. From the bottom of the stack to the top, here are a few examples of where encryption can be used: 

• at the storage level, to encrypt an entire storage device; 
• at the file-system level, to transparently encrypt individual folders/files and protect data at rest;
• at the database level, to encrypt specific columns; 
• at the application level, to selectively transform sensitive data early, either from the application itself or through a dedicated proxy. 

These different approaches are not exclusive—they can (and often should) be used conjointly. Each method has its pros and cons. But protecting data at the highest layer (i.e., the application layer) has many advantages. It allows for fine-grained control over what data is protected, enabling the protection of specific elements rather than encrypting entire files or databases. This approach is particularly useful for protecting personally identifiable information (PII) such as names or account numbers. Additionally, application-level encryption can be tailored to the needs of specific applications, allowing developers to implement custom protection schemes (data transformations) that may preserve a specific format, for example. Furthermore, protecting data at the application layer keeps it secure through its lifecycle, ensuring that sensitive information remains protected both at rest and in transit. Finally, it is also possible to configure how the data is revealed (or not), depending on the context of the request (i.e., who is requesting the data and how).