Encryption at Rest
Pronunciation: ehn-KRIHP-shun at REHST
Definition
Encryption at Rest is a security mechanism or control discipline that protects stored data by keeping database files, disks, backups, objects, or fields encrypted when not actively processed. Encryption at rest converts stored information into ciphertext so stolen media, snapshots, backups, or unauthorized storage access do not directly reveal plaintext.
Overview
Meaning and scope
Encryption at Rest is a security mechanism or control discipline that protects stored data by keeping database files, disks, backups, objects, or fields encrypted when not actively processed. Encryption at rest converts stored information into ciphertext so stolen media, snapshots, backups, or unauthorized storage access do not directly reveal plaintext.
Mechanism and operation
Effective deployment separates key management from storage, restricts decryption rights, rotates keys, protects backups, and tests restoration. Data classification determines which layer is appropriate, while access control, monitoring, minimization, and application security remain necessary against authorized-path disclosure. For Encryption at Rest, production scope should name the relevant data, keys, algorithms, identities, metadata, storage, transmission paths, and authorized recipients, the decision being supported, the accountable owner, and the time and jurisdiction boundaries. Encryption at rest reduces exposure from stolen storage, but active systems, authorized access paths, and key management remain vulnerable.
Practical payment example
A merchant database stores customer billing details encrypted on disk. Security reviewers also check key access and application permissions because disk encryption alone does not stop an authenticated attacker reading records.
Operational checks
Review of Encryption at Rest should determine whether safeguards addressing stored data by keeping database files, disks, and backups changed exposure in practice, not merely whether a document or setting existed.
Distinctions and limits
The security boundary depends on where decryption occurs and who can access the keys. Full-disk encryption protects a powered-off device but may not stop a compromised application or administrator from reading data through an authorized running system.
Related reading
Related definitions: Encryption.
Example
A merchant database stores customer billing details encrypted on disk. Security reviewers also check key access and application permissions because disk encryption alone does not stop an authenticated attacker reading records.
Comparison
Encryption at rest converts stored information into ciphertext so stolen media, snapshots, backups, or unauthorized storage access do not directly reveal plaintext. The security boundary depends on where decryption occurs and who can access the keys.
Key Takeaway
Encryption at rest reduces exposure from stolen storage, but active systems, authorized access paths, and key management remain vulnerable.
Sources
- NIST Documentation: Cryptographic Standards And Guidelines — NIST (2026-07-30)