# Encryption at Rest

> A mechanism that encrypts stored data with managed keys, so the storage medium alone does not reveal it.

Record: `architecture:encryption-at-rest`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: storage, database, backups
Canonical: https://banes-lab.com/ontology#architecture-encryption-at-rest

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Output Encoding](https://banes-lab.com/records/architecture/output-encoding.md) and before [Encryption in Transit](https://banes-lab.com/records/architecture/encryption-in-transit.md).

## Repair

- Refactored by: Enable Encryption, Add KMS
- Detected by: storage config scan
- Violated by: sensitive data stored unencrypted
- Measured by: encrypted storage coverage
- Enforced by: infrastructure policy

## Requires

- [Key Management](https://banes-lab.com/records/lexicon/key-management.md)

## Reinforces

- [Data Protection](https://banes-lab.com/records/lexicon/data-protection.md)

## Enables

- [Confidentiality of Stored Data](https://banes-lab.com/records/lexicon/confidentiality-of-stored-data.md)

## Conflicts with

- [Plaintext Sensitive Storage](https://banes-lab.com/records/lexicon/plaintext-sensitive-storage.md)

## In tension with

- [Key Operations](https://banes-lab.com/records/lexicon/key-operations.md)

## Tensions

- [Encryption at Rest / Key Operations](https://banes-lab.com/records/tension/encryption-at-rest-key-operations.md)

## Severity

- [contextual](https://banes-lab.com/records/vocabulary/severity-contextual.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)