Encryption at Rest

Kind: mechanism

Layer: Security Core

Record: architecture:encryption-at-rest

Severity: contextual

Scope: storage, database, backups

Canonical: Ontology

A mechanism that encrypts stored data with managed keys, so the storage medium alone does not reveal it.

Listed in Architecture principles, after Output Encoding and before Encryption in Transit.

Requires

• Key Management

Reinforces

• Data Protection

Enables

• Confidentiality of Stored Data

Conflicts with

• Plaintext Sensitive Storage

In tension with

• Key Operations

Tensions

• Encryption at Rest / Key Operations

Violated by

• Plaintext Sensitive Storage

Refactored by

• Key Management

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Linked from

• Security Privacy Compliance
• Severity levels
• The resolutions