What is Encryption at Rest
Stored data encryption
Encryption at Rest is a data protection method where information is encrypted when stored on physical media: disks, databases, backups.
What is Encryption at Rest
Unlike encryption in transit, encryption at rest protects data that is not moving but stored on servers, in the cloud, or on devices.
Key Methods
- Full Disk Encryption (FDE) — encrypting the entire disk
- File/Folder Encryption — selective encryption of specific data
- Database Encryption — protecting data at the DBMS level
- Transparent Data Encryption (TDE) — automatic encryption without application changes
Encryption Algorithms
- AES-256 — standard for most solutions
- RSA — asymmetric encryption for keys
- ChaCha20 — modern alternative to AES
Key Management
- KMS (Key Management Service) — centralized key management
- HSM (Hardware Security Module) — hardware key protection
- Key Rotation — periodic changing of encryption keys
Use Cases
- Compliance requirements (GDPR, PCI DSS, HIPAA)
- Protection against physical theft of media
- Cloud storage security
- Backup protection