Lessons · Cybersecurity · encryption at rest and in transit
Locked on the shelf, locked in the post
Encryption scrambles data so only somebody with the key can read it; at rest means stored on a disk, in transit means crossing a network, and each needs its own protection.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
In beta. This lesson was written for Hone and has not yet been checked by a practising security analyst. Practice material, not professional advice. What that means.
What it is for
The laptop was left in a taxi. Without disk encryption the client files on it are a breach to report and a letter to every client. With it, the laptop is a 1,200 dollar loss and the story ends there.
How to think about it
Ask where the data is at the moment you are worried about. Sitting on a disk, a phone or a backup drive is at rest, so encrypt the disk. Crossing a network is in transit, so use the protected version of the protocol. Most data needs both.
Worked example
At rest: laptop disk, backup drive, database filesEncrypt the whole disk, and lost hardware stops being lost data.
In transit: the login page, the file transfer, the link to head officeThe protected protocol, such as HTTPS. The padlock in the browser is this.
The method is public; the key is the secretEverybody knows how the lock works. The key is what you guard, back up, and never email.
Check: where is the key, and who can reach itAn encrypted disk with the password on a sticker is an unencrypted disk.
Your turn
Data sitting on a backup drive in a cupboard is data at which state? Finish the phrase.
data at
Solve one, graded on the server
The trap
Believing HTTPS protects the data after it lands. In transit ends at the server; what happens to it on the disk is a separate question with a separate answer.