Encryption: At Rest vs. In Transit
Home /
Glossary Index /
Alphabet E
Encryption At Rest vs. In Transit: What Your Data Needs to Stay Safe
Definition: Encryption is the process of converting data into an unreadable format using a cryptographic algorithm, so that only authorized parties with the correct decryption key can read it. In cybersecurity, encryption is applied in two primary contexts: when data is stored (at rest) and when data is moving between systems (in transit). Both are required for comprehensive data protection, and each addresses a fundamentally different risk.
Why Encryption Is Non-Negotiable
In 2023, the average cost of a data breach reached $4.45 million, according to IBM’s Cost of a Data Breach Report. A significant portion of breaches involve data that was either unencrypted or inadequately protected. Encryption does not prevent attackers from reaching your data, but it makes the data they find completely useless without the decryption key.
Regulators understand this. GDPR, HIPAA, PCI DSS, and most modern compliance frameworks either require or strongly recommend encryption for sensitive data, both at rest and in transit. If your organization handles personal data, financial records, or health information, encryption is a legal expectation in most jurisdictions.
What Is Encryption at Rest?
Encryption at rest protects data that is stored on a device, server, database, or cloud storage system. When data is not actively being transmitted or processed, it sits in storage. Encryption at rest ensures that if an attacker gains physical or unauthorized digital access to that storage, the data they find is unreadable without the decryption key.
Where it applies:
- Databases storing customer records or financial data
- Hard drives and SSDs on laptops, desktops, and servers
- Cloud storage buckets and blob storage
- Backup files and archives
- File servers and network-attached storage (NAS)
How it works: Data is encrypted before being written to storage, or the entire storage volume is encrypted at the disk level. Full-disk encryption tools like BitLocker (Windows) or FileVault (macOS) encrypt everything on a drive. Database-level encryption protects specific data fields or entire database files. Cloud providers offer server-side encryption options that encrypt data automatically when it is written to their storage systems.
Common encryption standards for data at rest:
- AES-256 (Advanced Encryption Standard with 256-bit keys) is the current gold standard for symmetric encryption at rest
- AES-128 is used where performance is more critical than maximum security
- RSA is used for encrypting small amounts of data and for key exchange
The risk it addresses: Physical theft, unauthorized server access, rogue insiders with storage access, or an attacker who exfiltrates a database backup file. If the storage is encrypted and the attacker does not have the key, the data is worthless to them.
What Is Encryption in Transit?
Encryption in transit protects data while it is moving between systems, such as from a user’s browser to a web server, between two servers in a data center, or between your laptop and a cloud application. Data in transit moves across networks that you do not fully control, and those networks are susceptible to interception.
Where it applies:
- HTTPS connections between browsers and web servers
- API calls between applications and services
- Email transmission using TLS
- File transfers using SFTP or FTPS
- VPN tunnels between offices or remote workers and corporate networks
- Database connections using SSL/TLS
How it works: Encryption in transit wraps data in an encrypted tunnel so that even if someone intercepts the network traffic, they see only ciphertext. TLS (Transport Layer Security) is the dominant protocol. When you see “HTTPS” in a browser URL, that means TLS is encrypting the connection between your browser and the server.
Common protocols for encryption in transit:
- TLS 1.2 and TLS 1.3 (the current standard; TLS 1.0 and 1.1 are deprecated)
- HTTPS (HTTP over TLS)
- SSH (Secure Shell) for secure remote connections
- SFTP and FTPS for secure file transfers
- IPsec for VPN tunnels
The risk it addresses: Man-in-the-middle attacks, eavesdropping on network traffic, session hijacking, and credential theft. If an attacker intercepts your data in transit but it is encrypted, they cannot read it.
At Rest vs. In Transit: Key Differences
|
Factor |
Encryption at Rest |
Encryption in Transit |
|
When data is protected |
While stored |
While moving between systems |
|
Primary threat |
Physical theft, unauthorized storage access |
Eavesdropping, man-in-the-middle attacks |
|
Common technologies |
AES-256, full-disk encryption, database encryption |
TLS 1.3, HTTPS, SSH, VPN, SFTP |
|
Key storage risk |
Encryption keys must be securely managed |
Certificate management and key exchange |
|
Compliance relevance |
HIPAA, GDPR, PCI DSS |
GDPR, PCI DSS, SOC 2 |
A Third State: Encryption in Use
Some organizations now implement a third form of encryption: encryption in use, also called confidential computing. This protects data while it is actively being processed in memory. Technologies like Intel SGX and AMD SEV create hardware-protected execution environments where data remains encrypted even during computation.
While still emerging, encryption in use is becoming relevant for organizations processing highly sensitive data in cloud environments where they cannot fully trust the underlying infrastructure.
Common Encryption Mistakes to Avoid
- Using outdated encryption standards. Algorithms like MD5, SHA-1, and DES are no longer considered secure. Use AES-256 for data at rest and TLS 1.3 for data in transit.
- Encrypting data but mismanaging keys. Encryption is only as strong as your key management. If encryption keys are stored alongside the encrypted data or are inadequately protected, your encryption provides limited protection.
- Relying on encryption in transit alone. If your data is encrypted during transmission but stored in plaintext in your database, an attacker who breaches your database gets everything. Both layers are necessary.
- Not encrypting backup files. Backup files contain the same sensitive data as your live systems. They must be encrypted with the same rigor.
Frequently Asked Questions About Encryption
HTTPS (TLS) protects data in transit between a browser and a server. It does not protect data stored on the server, in databases, or in backups. You need encryption at rest alongside HTTPS for comprehensive protection.
AES-256 is the current industry standard for encrypting sensitive data at rest. It is used by government agencies, financial institutions, and healthcare organizations worldwide. AES-256 has no known practical attacks when correctly implemented.
Modern hardware includes dedicated cryptographic processors that make encryption overhead minimal. For most use cases, the performance impact of AES-256 encryption is negligible. TLS 1.3 is significantly more efficient than earlier versions of TLS.
End-to-end encryption (E2EE) means data is encrypted on the sender's device and only decrypted on the recipient's device. No intermediate party, including the service provider, can read the data. WhatsApp and Signal use E2EE for messages.
