Encryption at Rest — Encrypting Stored Data

Encryption at rest protects data against physical access to the disk or database. Both a compliance requirement and common sense.

Encryption layers¶

• Full Disk Encryption: LUKS, BitLocker, FileVault
• File/Volume: dm-crypt, VeraCrypt
• Database: TDE (Transparent Data Encryption)
• Application-level: Encryption in code before storage
• Cloud: AWS KMS, Azure Key Vault, GCP KMS

LUKS — Linux¶

Disk encryption¶

cryptsetup luksFormat /dev/sdb cryptsetup luksOpen /dev/sdb encrypted_disk mkfs.ext4 /dev/mapper/encrypted_disk

Application-level¶

from cryptography.fernet import Fernet key = Fernet.generate_key() # Store in KMS! f = Fernet(key) encrypted = f.encrypt(b”sensitive data”) decrypted = f.decrypt(encrypted)

Key Takeaway¶

Encrypt data at all layers — disk, database, application. Keys in KMS, never alongside the data.