What is Encryption at Rest/Transit

Definition

Encryption at rest and in transit protects data by encoding it both when stored on disk and while moving across networks, so that intercepted traffic or stolen storage media remains unreadable without the corresponding decryption keys.

« Back to Glossary Index

Renders stolen disks, backups, or files useless without the decryption keys
Protects data crossing networks from interception and eavesdropping
Satisfies regulatory mandates that require encryption of sensitive data
Provides defence in depth that limits damage even if other controls fail

Real World Example

A health platform encrypts patient records at rest in its database and uses TLS for all API traffic, so neither a stolen backup nor intercepted network traffic exposes readable personal health information.

FAQs

What is the difference between encryption at rest and in transit?

At rest protects stored data on disk or in backups, while in transit protects data as it moves across networks using protocols like TLS.

Why is both needed?

Data is vulnerable both when stored and when moving, so protecting only one leaves a gap an attacker can exploit.

Does encryption replace access control?

No, encryption protects data confidentiality, but access control is still needed to decide who may decrypt and use it.