Encryption at Rest
The protection of stored data by transforming it into ciphertext that requires authorized cryptographic keys to read.
At-rest encryption reduces exposure if storage media, backups, snapshots, or accounts are compromised and supports many contractual and regulatory requirements.
A platform encrypts database volumes and backups with managed keys, restricts key use to service identities, logs decryption operations, and tests recovery procedures.
Encryption at rest does not protect data while an authorized application is processing it. Compromised identities or applications may access plaintext, and poorly managed keys can defeat the control or make data unrecoverable.
It applies to disks, databases, object storage, backups, devices, and archives. Controls may operate at hardware, volume, file, database, or application level. Effective protection depends on key generation, separation, storage, rotation, access control, backup, and recovery.
Data Engineering
NIST SP 800-111 — Storage Encryption — https://doi.org/10.6028/NIST.SP.800-111; NIST — Cybersecurity Framework — https://www.nist.gov/cyberframework