HC-explain Encrypt sensitive data both in transit and at rest

TLS/SSL:

• Use Transport Layer Security (TLS) or Secure Sockets Layer (SSL) to encrypt data sent over networks. This is typically handled at the network layer and is used in HTTPS.
• In C#, you can configure your HttpClient to use HTTPS, which automatically handles encryption.

using System.Net.Http;

var httpClientHandler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
};

using (var client = new HttpClient(httpClientHandler))
{
    var response = await client.GetAsync("https://secureapi.example.com");
    var content = await response.Content.ReadAsStringAsync();
}

WebSockets with TLS:

• For real-time communication, use WebSockets over TLS (wss://) to ensure data is encrypted.

Custom Encryption:

• For additional security, you can encrypt data before sending it over the network using symmetric or asymmetric encryption.

Symmetric Encryption (AES):

• Use the Advanced Encryption Standard (AES) for encrypting data. AES is a symmetric encryption algorithm, meaning the same key is used for both encryption and decryption.

using System;
using System.IO;
using System.Security.Cryptography;

public static byte[] EncryptStringToBytes_Aes(string plainText, byte[] Key, byte[] IV)
{
    if (plainText == null || plainText.Length <= 0)
        throw new ArgumentNullException(nameof(plainText));
    if (Key == null || Key.Length <= 0)
        throw new ArgumentNullException(nameof(Key));
    if (IV == null || IV.Length <= 0)
        throw new ArgumentNullException(nameof(IV));

    byte[] encrypted;

    using (Aes aesAlg = Aes.Create())
    {
        aesAlg.Key = Key;
        aesAlg.IV = IV;

        ICryptoTransform encryptor = aesAlg.CreateEncryptor(aesAlg.Key, aesAlg.IV);

        using (MemoryStream msEncrypt = new MemoryStream())
        {
            using (CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write))
            {
                using (StreamWriter swEncrypt = new StreamWriter(csEncrypt))
                {
                    swEncrypt.Write(plainText);
                }
                encrypted = msEncrypt.ToArray();
            }
        }
    }

    return encrypted;
}

Asymmetric Encryption (RSA):

• Use RSA for encrypting small amounts of data, such as encryption keys or passwords. RSA is an asymmetric encryption algorithm, meaning it uses a pair of keys (public and private).

Database Encryption:

• Use database features to encrypt data at rest. For example, SQL Server offers Transparent Data Encryption (TDE) and Always Encrypted features.

File Encryption:

• Encrypt files using libraries like System.Security.Cryptography to ensure that files stored on disk are secure.