We now, hopefully, understand some of the ways that encryption works and some of the ways that our infrastructure is vulnerable, but what about our application? It is entirely plausible that someone will want to break into your system. While a DDoS attack might cause you some inconvenience for a day or so, a hacker who gets past your firewall and into your application servers could cause serious financial or reputational damage. The first thing we need to do is to operate on a principle of no trust. David Strauss, in his talk, Don't build "Death Star" security (2016 O'Reilly software architecture conference) looked at the WikiLeaks website and concluded that it was not the first line of defense that fell, but that the attackers were able to gain access to various backend systems.
At the same conference, Sam Newman, who wrote the excellent Microservices book (which I encourage everyone to read if they have not yet done so), was also giving a talk on Application Security...