Security Operations
When running a webhosting business security as a primary concern. Customers want to know that all of their data is secure and can not be either stolen or damaged in anyway.
There are two different types of security, there is technical security which involves the use of technical methods to stop or investigate security incidents. And there is Policy security which concerns the organizations policy on how employees should handle data, an example of this would be training to recognize phishing scams or only giving rights to certain data to certain people.
A security incident is characterized as something the breaks any part of the CIA triangle. The CIA triangle is comprised of confidentiality (data is not seen by anyone who does not need to see it), integrity (the data is as it should be and has not been altered or changed in any way) and availability (being the availability of data or of a site).
Multiple parts of the triangle can be broken by an incident. Incidents can be caused for a variety of reasons from simple accidents exposing data or to malicious actors trying to damage the site or to steal data.
Encryption is a greatly important part of security, there are multiple different types of it, standard encryption which is where data has a password applied to it scrambling the data ad the same password can be applied again to de scramble it.
Hashing is where an algorithm is applied to the data scrambling the data, this data can not be unscrambled, a use of this is in the storage of passwords in databases as algorithms can see if an entered passwords is an unscrambled version of a scrambled version in a data base by looking at which encryption algorithm was used, but if the password is not given you can not revers the scrambling.
Finally there is PKE (Public key encryption) which works with there being two keys, a private key that does not leave your computer and a public key that does. The method of encryption essentially works in one large circle where at some point across it the data will be encrypted with on of the keys (in this case lets say the public), the data will be de encrypted at some point in the circle but it is not known where so even with the key it is not 100% guaranteed to decrypt it.
With PKE the integrity of a public key can be checked via certificate companies. These companies do this via taking the public key of the company that wants it verified, the certificate company will sign this key, this essentially is just encrypting it with there private key. The certificate will then decrypt it with there public key which will give the public key of the company verifying its integrity.