Encryption at Rest
Practice this topic in a realistic system design interview
Suppose an application stores customer data in a database. We usually protect that database with passwords, network rules, and access controls. But those protections only apply when someone goes through the database.
What if someone gets the storage itself? A hard drive might be thrown away without being wiped properly. A backup file might be uploaded to a storage bucket that was accidentally made public. A snapshot might be shared with the wrong cloud account.
In these cases, the attacker never logs in to the database. They simply read the raw files. And if those files are stored as plain text, every record is readable.
Encryption at rest solves this problem by making sure stored data is unreadable without the right key.
In this chapter, we will look at what encryption at rest is, the different layers where it can be applied, how encryption keys are managed, and what it does and does not protect against.