Encryption at Rest Explained
What Encryption at Rest Protects
Encryption at rest means data is stored in encrypted form on disks, volumes or object storage, so it can only be read by a system that holds the correct key. Data is encrypted before it is written and decrypted when an authorized system reads it. Anyone who obtains the raw storage media without the key sees only unreadable ciphertext.
This protects against specific risks: a drive removed from a server, a failed disk returned to a vendor, a copy of a storage volume taken without authorization, or a discarded drive that was not wiped properly. It does not protect against everything, as explained below.
Where Encryption Can Happen in the Storage Stack
Encryption can be applied at several layers. Block-level encryption covers everything on a device or volume, usually with a tool such as dm-crypt on Linux, and it works beneath any file system. File system-level encryption protects individual datasets inside a file system that supports it. Object-level encryption is applied by the storage service to each stored object, with keys managed either by the provider or by the customer.
Each layer has different trade-offs in performance, flexibility and what it can protect. Lower layers cover everything with little planning, while higher layers allow different keys for different data.
Key Management and Its Limits
Encryption is only as strong as the handling of its keys. Keys should be stored apart from the data they protect, limited to authorized access, and backed up, because losing a key usually means losing the data. Many systems use a hierarchy in which a master key protects the data keys, which makes rotation easier.
Encryption at rest does not hide data from a running system. Once a disk is unlocked or a service holds the key, software with access sees plain data. It also does not replace access control, so users with legitimate access and attackers who compromise a running server are not stopped by it. Protecting data while it moves across a network is a separate concern.
Returning a Failed Drive Safely
A hosting company replaces a failed drive in a storage server. The drive is encrypted, and its key is held in a separate key management system, so the faulty drive can be returned to the vendor or destroyed without exposing customer data. Had the drive been unencrypted, anyone who could attach it to another machine could read its contents.
Frequently asked questions
Is encryption at rest enough to protect my data?
Not on its own. It protects stored data against physical theft and misplaced drives, but it does not stop attacks on a running system, stolen credentials or accidental deletion. Combine it with access control, software updates, monitoring and separate backups for a complete approach.
What happens if the encryption key is lost?
The encrypted data usually becomes permanently unreadable. Strong encryption is designed so that, without the key, no practical method recovers the plaintext. Store keys in a recovery system separate from the data, and test that recovery works before you need it.