Data Security (Encryption at Rest & in Transit)

📘 Chapter 13: Security Architecture ⏱️ 8 min read 🏗️ Lesson 056

Data is the ultimate target of most attacks. Whether it's at rest on disk or in transit across the network, encryption ensures that even if attackers gain access to the storage or intercept the traffic, the data remains unreadable without the proper keys.

Encryption at Rest

Level What's Encrypted Protects Against
Disk-level (FDE) Entire disk volume Stolen/decommissioned hardware
Database-level (TDE) Database files on disk Unauthorized file access, backups theft
Field-level Individual columns/fields (SSN, CC#) DBAs, SQL injection, data leaks in logs

Each level adds protection but also complexity. Use disk-level as a baseline; add field-level for sensitive data.

Key Management & Envelope Encryption

Envelope Encryption Master Key (CMK) Stored in KMS Never leaves KMS hardware Data Key (DEK) Encrypts your data Generated per object/table Encrypted DEK Stored alongside data Encrypted Data Ciphertext on disk encrypts encrypts wraps DEK ✓ Rotate master key → re-encrypt only DEKs (fast!), not all data ✓ Compromise one DEK → only that object exposed, not everything
Figure 1: Envelope encryption — master key encrypts data keys, data keys encrypt data. Limits blast radius of any key compromise.

Hashing vs Encryption

Property Hashing Encryption
Reversible? No (one-way) Yes (with key)
Use case Passwords, integrity checks PII, credit cards, secrets
Algorithm bcrypt, Argon2 (passwords); SHA-256 (integrity) AES-256-GCM, ChaCha20
Key rule Use salt + work factor Manage keys separately from data

Rule of thumb: If you never need the plaintext back → hash. If you need to retrieve it → encrypt.

Data Classification

Level Examples Protection
Public Marketing pages, docs Integrity only (no encryption needed)
Internal Employee directory, internal wikis Access control, TLS in transit
Confidential Customer PII, financial records Encrypted at rest + in transit, audit logs
Restricted Passwords, encryption keys, health records Field-level encryption, HSMs, strict access

Secrets Management

Never Hardcode Secrets

  • HashiCorp Vault: Dynamic secrets, lease-based access, auto-rotation
  • AWS Secrets Manager: Managed rotation, IAM-based access, encrypted storage
  • Environment variables: Better than code, but still visible in process lists
  • Git-crypt / SOPS: Encrypt secrets in repos (for infrastructure-as-code)

Principle: Secrets should be injected at runtime, never stored in source code, and rotated regularly.

Real-World Examples

Equifax Breach (2017): The Cost of Unencrypted Data

Attackers exploited an unpatched Apache Struts vulnerability and accessed 147 million records — SSNs, birth dates, addresses. Much of this data was stored unencrypted. Had field-level encryption been applied to SSNs, the stolen data would have been useless ciphertext. The breach cost Equifax $1.4 billion and demonstrated why "encrypt by default" isn't optional.

Apple iMessage: End-to-End Encryption

iMessage uses end-to-end encryption — messages are encrypted on the sender's device and only decrypted on the recipient's device. Apple cannot read them even if compelled by law enforcement. Each device has its own key pair; messages are encrypted separately for each recipient device. This is envelope encryption at the application layer — user keys encrypt message keys, which encrypt messages.

Interactive: Classify Data & Choose Protection

Data Protection Decisions

For each data type, choose the appropriate protection method: