Its primary purpose is confidentiality: without the appropriate key, an unauthorized party should not be able to recover the original information.
Symmetric encryption uses a shared secret key for encryption and decryption. Asymmetric encryption uses a related public and private key pair and is commonly combined with symmetric encryption in practical protocols. Encryption may protect stored data or data moving between systems, but the actual protection depends on the complete implementation, including endpoint security, protocol design, algorithm and mode selection, and key management.
Key points
Data at restMay protect storage devices, databases, files, backups, or selected fields against defined access and loss scenarios.
Data in transitProtocols such as correctly configured TLS can protect communications while they cross untrusted networks.
IntegrityEncryption alone does not necessarily detect modification; authenticated encryption or a correctly composed integrity mechanism is often required.
Key lifecycleSecure generation, storage, distribution, rotation, recovery, revocation, backup, and destruction are central to the control.
Important limitationEncryption does not protect plaintext while an authorized or compromised endpoint can access it, and it does not by itself provide availability, erase metadata, or stop an authorized recipient from misusing data.