Encryption at Rest

Overview

Encryption at rest converts stored information into ciphertext so stolen media, snapshots, backups, or unauthorized storage access do not directly reveal plaintext. It may operate at disk, volume, database, object, application, or individual-field level.

The security boundary depends on where decryption occurs and who can access the keys. Full-disk encryption protects a powered-off device but may not stop a compromised application or administrator from reading data through an authorized running system.

Effective deployment separates key management from storage, restricts decryption rights, rotates keys, protects backups, and tests restoration. Data classification determines which layer is appropriate, while access control, monitoring, minimization, and application security remain necessary against authorized-path disclosure.

For Encryption at Rest, production scope should name the relevant data, keys, algorithms, identities, metadata, storage, transmission paths, and authorized recipients, the decision being supported, the accountable owner, and the time and jurisdiction boundaries.

Encryption at Rest is a security mechanism or control discipline that protects stored data by keeping database files, disks, backups, objects, or fields encrypted when not actively processed. Encryption at rest reduces exposure from stolen storage, but active systems, authorized access paths, and key management remain vulnerable.

A production treatment of Encryption at Rest should test protection of stored data by keeping database files, disks, backups, objects, or fields encrypted when not actively processed within the relevant asset, decision, or service state. The Encryption at Rest context record for stored data by keeping database files, disks, and backups should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Encryption at Rest should determine whether safeguards addressing stored data by keeping database files, disks, and backups changed exposure in practice, not merely whether a document or setting existed.