Home / Knowledge hub / Encryption at rest
Knowledge hub
Encryption at rest
Stored data scrambled so a stolen disk is useless without the key.
What it means
Encryption at rest scrambles stored data so a stolen disk or a copied database file is useless without the key. Your hosting provider will usually do it for you behind one setting.
The detail that decides its value is who holds the key. When the key sits beside the data and the application reads it automatically, anything that can reach the application can read the data.
Why it matters
It protects against theft of the storage. It does nothing about an attacker already signed in as a valid user. Storage theft is a real risk, and it covers old backups, retired hardware and stray database copies. Switch it on. Just be clear which question it answers.
It is also the control most often oversold in a sales conversation, usually in good faith. Saying the data is encrypted is true and answers a narrower question than the customer asked. Being precise costs nothing and saves the awkward exchange later, when somebody asks what a hijacked support account would have reached.
How it shows up
The honest question is not whether it is switched on. It is what it would have stopped. Write down the last three plausible ways data could leave your product, then ask which of them this setting prevents. Often the answer is none, and that is fine, as long as nobody treats one checkbox as an answer to a security questionnaire.
What deserves attention next: protection for the most sensitive fields, key rotation, and exactly who can read a backup. Buyers ask all three in a serious review.
Questions people ask
Encryption at rest, answered
If the application can decrypt the data, what is the point?
The point is the scenario it was designed for. Somebody who takes the disk, the backup file or the retired drive gets nothing readable.
NIST's storage encryption guidance frames it exactly that way. It protects data on stored media, not data in a running system that has already authenticated somebody.
Is cloud provider encryption enough, or do we need to encrypt fields ourselves?
Provider-managed encryption is enough for the stolen-media case, and for most products that is the honest answer.
Encrypt individual fields when a specific column would be damaging on its own, such as government identifiers or health data, and when you can keep that key away from the database. OWASP's cryptographic storage guidance walks through the choices.
Does encryption at rest protect us if an admin account gets taken over?
No. The application decrypts for whoever it believes is asking, and a stolen admin session looks exactly like an admin.
What limits that damage is authorisation, export limits and logging. Those are application controls, and they are the ones we test.
Is hashing the same as encryption at rest?
No. Hashing is one way, for things you only ever need to verify, like passwords. Encryption is reversible with the key, for things you need to read back.
Storing passwords encrypted instead of hashed is a common and serious mistake. Cyberlop does not review your hashing implementation, so ask your engineers which one they used.
Who should hold the keys?
Somewhere the application can use them and an attacker with database access cannot copy them. A managed key service is the ordinary answer for most teams.
Whatever you choose, write down who can retrieve a key, and check that list is shorter than you fear.
Sources
Where this comes from
Related
Terms that sit next to this one
Encryption in transit
Protecting data while it travels between a browser and your servers.
Key rotation
Replacing a credential on a schedule so a leaked one has a short life.
PII
Any data that points at a specific human being.
Security questionnaire
The list of questions a buyer's security team sends before they sign.
Hashing
A one-way transformation, so a password can be checked but never read back.
Encrypted, and still readable?
Storage encryption does nothing against a user who is already signed in. We test what a valid account reaches that it should not, and prove it with the response. Start with one application.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.