Figure 17�2 shows the Employees table with one column marked for encryption. The column-encryption key for the Employees table is retrieved from the external security module and used to encrypt that marked column. The figure shows the Employees table thereafter with that marked column's data encrypted. The second half of Figure 17-2 shows the reverse process, whereby the encrypted column is decrypted, again by use of the column key retrieved from the external security module.