When & How to Properly Encrypt
When deciding where and how you want to apply encryption, it is important to consider what sorts of attacks you're actually expecting to prevent and whether or not the data you're encrypting actually needs strong protection in the first place.
This breaks down into three main factors:
- Sensitivity of the data. A database of all your account passwords, specifics about your financial or medical histories, and pictures of your genitalia are all certainly in need of some amount of protection. That funny cat meme that you're going to post to Twitter, not so much.
- Likely attack vectors. If you want to use encryption to protect your data, it needs to stay protected no matter where it is. This means keeping it encrypted whether it's on your computer, flying across the Internet, or sitting in some sort of cloud backup. This protects against burglars, state/corporate proxies, and cybercriminals, respectively.
- Capabilities of likely attackers. Odds are, most of the burglars and cybercriminals who are going to want a look at your data will be opportunists. They won't likely be well-equipped or motivated enough to mess with trying to break or work around at-rest data encryption at all - they'll just move on to the next target. State-level actors or other APTs might not be so stymied, but they may also have other ways to make your life miserable even if they never get your data.
So, take that all together and here's what you do:
All Data At Rest on Your PC & Removable Media
Encrypt your entire hard drive(s). Don't leave anything in the clear. This protects the sensitive data in its primary storage location, as well as any local system caches or page files that it might get leaked to. As a side-effect, all non-sensitive data on the same drives is protected as well. (At least, until you send it somewhere else.)
All Non-Sensitive Data Leaving Your Control
If you're posting it on a public forum or social media, consider it already compromised and move on. If that thought makes you queasy, don't post it.
Sensitive Data That's Traversing the Internet
Make sure proper transport-layer security (not necessarily TLS, but it generally is) is in place to encrypt the connection between your PC and the remote endpoint. Also be sure that you trust the remote endpoint to properly handle and protect whatever data you're sending to it. If you don't, see the next section.
Sensitive Data Going to Someone Else's PC
There's a lot of ways that you might want to pass data to someone else's computer directly. It is also important to recognize that e-mail and cloud storage reside on "someone else's computer". If it's sensitive, and it's leaving your control, this is where tools like encrypted containers and files (herein referred to collectively as "file-level encryption") come in.
Why File-Level Encryption is Important
With file-level encryption, it doesn't matter whether the data is passing the network over a cleartext protocol or sitting on a computer that doesn't have whole-disk encryption. Regardless of where it goes, an encrypted file will always have a non-trivial layer of protection around it in its primary storage location.
This is not to say that the file's contents cannot be exposed while they sit in a clear cache, page file, hibernation file, or RAM. However, accessing these storage locations is slightly more difficult than simply reading the file from primary storage. It also requires a certain amount of luck, as any data stored in those areas is transient by nature.
Ultimately, how other people manage the computers that contain the data you send to them is beyond your control. This is why you shouldn't release control of sensitive data to people you don't trust to properly protect it. If you must release your sensitive data though, file-level encryption is about the best you can do to make sure it stays safe. At the very least (since the remote party could ultimately just decrypt the data and leave it in the clear) you'll be able to say you've done as much as you can.
A Note on Encrypting External Drives
Keeping all data on an encrypted external drive does nothing to protect it, that couldn't be equally accomplished by file-level encryption on an internal drive. As soon as you go to read that data, it'll get caught up in the same cleartext-by-default locations (caches, pagefiles, RAM, etc) that it would if it were stored on the internal drive. This is why you should apply whole-disk encryption to systems that handle sensitive data wherever possible.
On top of this, whenever the external drive is mounted, the decryption key will also land in those same areas. This is why systems handling data that does warrant encryption should never be put to sleep - only shut down or hibernated - and should have (at least) their system drives fully encrypted.