Encryption, Hashing & GRC
How data stays secret (encryption), how you verify it hasn't been tampered with (hashing), and how organisations manage security at scale (GRC).
How do we protect data?
Encryption is a locked box. Hashing is a fingerprint.
Encryption: You put a letter in a locked box and give the key to the recipient. They unlock it and read the letter. Anyone who intercepts the box can’t read the letter without the key.
Hashing: You take a fingerprint of the letter. You can’t recreate the letter from the fingerprint, but you can check whether someone has changed it by comparing fingerprints. If the fingerprints match, the letter is untampered.
GRC: The rules, checklists, and processes an organisation follows to manage security risks and meet legal requirements.
Encryption: keeping secrets secret
Symmetric vs asymmetric encryption
| Feature | Symmetric | Asymmetric |
|---|---|---|
| Keys used | One shared key (same for encrypt and decrypt) | Two keys — public key (encrypt) and private key (decrypt) |
| Speed | Fast — good for large data | Slower — good for small data or key exchange |
| Analogy | A padlock where both people have the same key | A letterbox — anyone can drop mail in (public), only you can open it (private) |
| Example | AES encryption for files at rest | TLS handshake, digital signatures, HTTPS |
| Challenge | How do you safely share the key? | Slower performance for bulk data |
Encryption at rest vs in transit
| Type | What It Protects | When It Applies | Example |
|---|---|---|---|
| At rest | Stored data | Data sitting on a disk, database, or storage account | Azure Storage encryption, BitLocker |
| In transit | Moving data | Data travelling across a network | HTTPS/TLS, VPN tunnels |
Key exam concept: Microsoft encrypts data at rest by default in Azure and Microsoft 365. Data in transit is protected by TLS. The exam expects you to know both types exist and when each applies.
Scenario: Sam protects customer data at BrightStar
BrightStar’s online store processes credit card payments.
- In transit: When a customer enters their card number, HTTPS (TLS) encrypts it between their browser and Sam’s web server. Anyone intercepting the traffic sees gibberish.
- At rest: The payment processor stores transaction records encrypted on disk. Even if someone steals the hard drive, they can’t read the data without the encryption key.
Sam doesn’t configure this manually — Azure handles encryption at rest by default, and HTTPS is standard for web traffic. But Sam needs to understand WHY both matter.
Hashing: verifying integrity
Hashing takes any input and produces a fixed-length string (the hash or digest). Key properties:
- One-way: You cannot reverse a hash to get the original input
- Deterministic: The same input always produces the same hash
- Avalanche effect: A tiny change in input produces a completely different hash
- Fixed length: No matter how big the input, the hash is always the same size
Common use cases
| Use Case | How Hashing Helps |
|---|---|
| Password storage | Stores hashed passwords, not plaintext. Even if the database leaks, attackers get hashes — not passwords. |
| File integrity | Download a file and compare its hash to the published hash. If they match, the file hasn’t been tampered with. |
| Digital signatures | Hash the document, then encrypt the hash with a private key. The recipient decrypts with the public key to verify authenticity. |
Hashing + salting
A salt is random data added to the input before hashing. This prevents two identical passwords from producing the same hash — defeating rainbow table attacks.
Key exam concept: The exam tests whether you know the difference between encryption (reversible, protects confidentiality) and hashing (one-way, protects integrity). Passwords should be hashed, not encrypted.
Exam tip: encryption vs hashing
If the question asks about protecting confidentiality (keeping data secret) → Encryption.
If the question asks about verifying integrity (confirming data hasn’t changed) → Hashing.
If the question asks about password storage → Hashing (with salting). Never store passwords in plaintext or encrypted form.
Trap question pattern: “Which method allows you to recover the original data?” → Encryption (not hashing — hashing is one-way).
GRC: Governance, Risk, and Compliance
GRC is how organisations manage security at a business level — not just technical controls, but policies, processes, and accountability.
| Component | What It Means | Example |
|---|---|---|
| Governance | The rules and policies that guide an organisation’s security strategy | ”All employees must use MFA” — set by leadership |
| Risk | Identifying, assessing, and managing threats to the organisation | ”What happens if our customer database is breached?” — risk assessment |
| Compliance | Meeting external legal, regulatory, and industry requirements | GDPR (privacy), HIPAA (healthcare), PCI DSS (payment cards) |
Scenario: BrightStar faces GRC in retail
Sam’s BrightStar Retail handles credit card payments, which means PCI DSS compliance:
- Governance: Sam creates a security policy requiring MFA for all employees and encrypted payment processing.
- Risk: Sam identifies that an unsecured Wi-Fi network in the store is a risk to customer card data. They install a separate, isolated network for POS terminals.
- Compliance: PCI DSS requires regular security scans and access controls. Sam uses Microsoft Compliance Manager to track their progress against these requirements.
GRC is not a product — it’s a framework. Microsoft provides tools (Compliance Manager, Purview) to help, but the responsibility for governance and risk decisions stays with the organisation.
🎬 Video walkthrough
🎬 Video coming soon
Encryption, Hashing & GRC — SC-900 Module 3
Encryption, Hashing & GRC — SC-900 Module 3
~9 minFlashcards
Knowledge Check
BrightStar stores customer passwords in their online store database. Sam wants to ensure that even if the database is compromised, attackers cannot read the passwords. What should Sam use?
Sam needs to verify that a software update downloaded from a vendor hasn't been tampered with during transit. Which technology should Sam use?
Which GRC component requires BrightStar to follow PCI DSS rules because they process credit card payments?