Encryption in transit and at rest

📘What it really is

• Encryption turns readable data (plaintext) into unreadable data (ciphertext) using a key. Only someone with the right key can turn it back.

• In transit: while data moves over networks. TLS (Modules 66 and 76) handles this for HTTPS, database connections and service calls.

• At rest: while data is stored:

• disk encryption: cloud disks and managed databases usually encrypt by default; turn it on for laptops (BitLocker, FileVault, LUKS) where your keys and data live;
• backups: encrypt before sending off-site (Module 72), with the key kept separately;
• object storage: server-side encryption is usually on by default;
• field-level encryption: encrypting particularly sensitive columns (for example, ID numbers, bank details) in the app before storing, so even someone reading the database sees ciphertext.

• What disk encryption doesn't protect against: anyone who can log in to the running system, or the app itself being compromised. It mainly protects against lost devices and stolen disks. That's why access control (Module 74) still matters.

• Two kinds of encryption:

• symmetric: one shared key encrypts and decrypts (AES); fast, used for data;
• asymmetric: a key pair, public and private (RSA, elliptic curves); used to exchange keys and for signatures, as in TLS and SSH keys (Module 64).