Board Technology Oversight

Encryption Is a Definition, Not a Complete Answer

Encryption turns readable information into ciphertext using a cipher and a key. Understanding the term is different from evaluating a whole product.

A combination lock beside a closed laptop.

"It is encrypted" can sound like the end of a conversation. Often it is the beginning of a definition. Before asking what the phrase means for a product, it helps to know what the word itself says and what it leaves unstated.

MDN defines encryption as transforming a plaintext message into ciphertext using an algorithm called a cipher. Modern encryption also uses a key. That is a technical concept with a fairly compact ordinary-language explanation.

This article stays at that explanatory level. It does not evaluate a product, recommend a security configuration or tell a business which protection is sufficient.

TLDR

  • Plaintext and ciphertext name the readable and transformed forms of a message.

  • A cipher is the algorithm used for that transformation.

  • The key is part of how modern encryption works.

  • A definition does not by itself evaluate a product or its handling of information.

Start with the words, not the reassurance

Imagine an invented sentence in a classroom example. The readable sentence is the plaintext. After a cipher transforms it, the resulting text is the ciphertext. This is a vocabulary illustration, not a recommendation to use a homemade cipher.

The useful distinction is that encryption describes a transformation. Calling a product "encrypted" does not, by itself, describe everything the product does. It leaves the reader with questions about the particular claim being made.

Keep the key separate from the metaphor

MDN explains that the algorithm may be public while the key must remain secret for the encryption to remain secure. A familiar lock metaphor can help introduce that distinction, but it is still a metaphor. It should not replace the technical definition.

A leadership explanation can say, "The cipher is the method; the key is an input used with that method." That gives the audience enough vocabulary to follow a discussion without pretending to teach cryptography in a paragraph.

Ask what the speaker is describing

When the word appears in a product presentation, an ordinary clarification question is "Which part of the explanation does that sentence refer to?" The presenter can then name the feature or the information being discussed.

This is different from declaring that the product is suitable or unsuitable. Understanding a sentence is one step; assessing the system behind it is another. A clear meeting keeps those steps separate rather than treating a familiar term as a complete assessment.

The same communication habit applies beyond encryption: first define the term, then establish the scope of the claim, then decide what further expertise the discussion needs. The definition helps readers follow the conversation. It does not settle the underlying decision.

Sources for the definitions and writing principles discussed here: Mozilla MDN, Encryption glossary, definitions of plaintext, ciphertext, cipher and key. The examples and suggested discussion formats are illustrative.

The related discussion of a technical conversation easier to follow is worth your time alongside this one.

Frequently asked questions

Does ciphertext mean the information has disappeared?

No. It names the transformed form of a message. The distinction here is between readable plaintext and ciphertext, not between existing and deleted information.

Is this a guide to choosing encryption?

No. It explains a small vocabulary set and makes no recommendation about algorithms, settings or product suitability.

Does knowing the definition qualify someone to assess a system?

No. Vocabulary can make a discussion clearer without replacing the expertise and evidence needed for an assessment.

A practical next step

In the next technology presentation, pause at one reassuring term and ask for its definition and scope. The aim is understanding before judgment. Book a Decision-Clarity Call for help making a technical conversation easier to follow.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Board Technology Oversight

All CISO Insights
Board Technology Oversight

Concentration Risk in One Cloud Region

When most workloads sit in one cloud region, one failure reaches everything. A dependency heat map shows where the blast radius is bigger than intended.