Encryption at Rest

Technical explanation

It applies to disks, databases, object storage, backups, devices, and archives. Controls may operate at hardware, volume, file, database, or application level. Effective protection depends on key generation, separation, storage, rotation, access control, backup, and recovery.

Business relevance

At-rest encryption reduces exposure if storage media, backups, snapshots, or accounts are compromised and supports many contractual and regulatory requirements.

Implementation example

A platform encrypts database volumes and backups with managed keys, restricts key use to service identities, logs decryption operations, and tests recovery procedures.

Limitations and common misconceptions

Encryption at rest does not protect data while an authorised application is processing it. Compromised identities or applications may access plaintext, and poorly managed keys can defeat the control or make data unrecoverable.

Topics

Sources