What is Encryption at Rest?
Encryption applied to data stored on disks, databases, or other storage media. When data is 'at rest' (not actively being transmitted), encryption protects it from unauthorized access if storage devices are stolen or compromised.
Also known as: Data at Rest Encryption, Storage Encryption
Encryption at rest protects your data when it's sitting on a drive—whether your laptop gets stolen, a server is breached, or old hardware is improperly disposed of. The data remains unreadable without the key.
What "At Rest" Means
At Rest
- Stored on hard drives
- In databases
- On backup tapes
- In cloud storage
- Not currently being processed
vs In Transit
- Moving across networks
- Being transmitted
- TLS/HTTPS protection
vs In Use
- Actively being processed
- In memory
- Hardest to protect
Types of Encryption at Rest
Full Disk Encryption (FDE)
- Entire drive encrypted
- BitLocker (Windows)
- FileVault (Mac)
- LUKS (Linux)
- Transparent to user
File-Level Encryption
- Individual files encrypted
- More granular control
- Can have different keys per file
- VeraCrypt, Cryptomator
Database Encryption
- Transparent Data Encryption (TDE)
- Column-level encryption
- Application-level encryption
- Key management critical
Cloud Storage Encryption
- Provider-managed keys
- Customer-managed keys
- Client-side encryption
Who Holds the Keys?
You Hold Keys
- Maximum protection
- Provider can't access
- You're responsible for key management
- Loss means data loss
Provider Holds Keys
- Easier management
- Provider can access (and may be compelled)
- Still protects against physical theft
- Common default
Hybrid
- Provider manages, you control
- Bring Your Own Key (BYOK)
- Balance of convenience and control
Benefits
- Protection if device is stolen
- Compliance requirements satisfied
- Data breach mitigation
- Secure decommissioning
Limitations
- Doesn't protect from authorized users
- Keys in memory during use
- Doesn't protect data in transit
- Key management complexity
Related Terms
AES
Advanced Encryption Standard is a symmetric encryption algorithm adopted by the U.S. government and used worldwide. It's the gold standard for encrypting sensitive data, used in everything from HTTPS to disk encryption.
Encryption
The process of converting information into a code to prevent unauthorized access. Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using a cryptographic algorithm and key. Only those with the correct key can decrypt and read the original data.
Have more questions?
Use our guided flow to get the right next privacy step for Encryption at Rest.
Open Guided Flow