I have a question about regulatory compliance. If I am required to have data at rest secured (encrypted), what are they looking for? Should my database files be encrypted, or is data at rest referring to my actual disk drives being fully encrypted? Or maybe both?


You might want to ask your company lawyer to help define what that means in your specific circumstances.

As for the usual definition of the term "data at rest": It means "stored data which isn't currently being accessed". So, for example, data at rest would be data sitting on a server's hard drives while the server is turned off, or data on backup tapes, or data sitting in a file that isn't opened by any of the running processes on a system, and so on.

So I'd say that what you need to do is encrypt all the data that falls under the requirement to be secured when it is at rest. Depending on what your data is, it might be enough to just encrypt the contents of a database before you store them in the database, or you might need to encrypt the file system the database sits on.

Edit: If you just encrypted the file system, but not the application data itself, you'd also need to make sure that backups of your application data, which also constitute data at rest, are encrypted, and so on.

For example, if you only encrypt text fields in a relational database, that might not be enough, because the relations between records would still be accessible. If you only encrypted your filesystem and then took a backup of the data while the filesystem was mounted and the plaintext data accessible, you'd then also need to encrypt the backup.

Like I said, do have legal counsel define it; your circumstances might vary, and security.stackexchange.com isn't law.stackexchange.com.


Having data at rest secured can refer to both confidentiality and integrity. Encryption can be an answer to the former but not to the latter.

That's the reason why best practices recommend to have offline archives of sensitive data in a different center that the one where the data is normally used. That way, in case of a major disaster (earthquake, bombs, hacking), the data can be restored from the offline copies.

  • A very good point to add integrity; I didn't think of that. But isn't your answer more about availability instead (which I also forgot, and which is also very important?) Wouldn't integrity also consist of detecting modifications and data corruptions? – Out of Band Nov 8 '16 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.