What controls are necessary for encrypted data at rest be both available to authorized processes and secure from unauthorized use?

Question

I understand that good information security practices are to encrypt data at rest so that it is unusable in the event that it is accessed by unauthorized users. What I don't understand is how a computer system can provide this level of security while also making data available to authorized users. Assuming symmetric encryption, at some point a computer system (a DMBS, for example) is going to need to access a plaintext cryptographic key so that it can decrypt data for authorized users. What I don't understand is how a system can ensure that data is encrypted against unauthorized access, and that unauthorized access cannot also access the cryptographic key the systems needs available to it for authorized access. What security controls are typically used to secure a system like this?

Answer 1

Security measures are always about a control which protects or mitigates certain threats.

For data at rest, one threat is theft of the physical storage units containing the data. If the control is that the data is encrypted, then the data is not released as a result of that physical theft.

Another threat is unauthorised access while the data is in the context of the solution system. If the control is that the data is encrypted, then non-authorised users cannot access it. Authorised users can provide the decryption key as part of their login session, so that the encrypted data is only available to them in the context of an authorised session. Alternatively, depending on the access method, the data could be pulled back to authorised users in encrypted form and decrypted locally; this provides protection against compromise of the data server sessions.

You specifically ask "What I don't understand is how a system can ensure that data is encrypted against unauthorized access, and that unauthorized access cannot also access the cryptographic key the systems needs available to it for authorized access"

The answer is that unauthorised users do not have access to the login session within which the authorised users provide the decryption key.