What is the difference between encryption at rest and in transit on a server?
Encryption at rest protects stored data under the chosen storage or application design. Encryption in transit protects data while it crosses a communication link, for example through properly verified TLS or SSH. Each addresses a different exposure and neither replaces access control or secure application behaviour.
Before you start
- A map of sensitive data, storage locations and network connections.
Instructions
1. Identify where protection is needed
Include databases, disks, snapshots, log archives and object storage, as well as browser, API, database and administrative connections. Check each link separately: HTTPS to a proxy does not automatically encrypt the proxy’s connection to a backend server.
2. Understand the trust boundary
Disk encryption can protect an offline lost device but usually cannot prevent a fully authorised running application from reading its own data. Application-level encryption can provide a different boundary if keys and permissions are designed accordingly. In transit, verify the peer’s identity as well as enabling encryption; accepting any certificate weakens that protection.
3. Plan operational access and recovery
Assign ownership for keys and certificates, restrict their access and define renewal or rotation. Confirm that authorised recovery can retrieve the required keys without the original server. Test the complete path and document any intentionally unencrypted segment with the responsible owner.
Check the result
- Sensitive storage and network paths use the intended encryption with verified identities.
- Authorised recovery remains possible using protected key material.
Troubleshooting
- Encrypted storage still exposes data after an administrator account is compromised
- Review the threat model and permissions. Encryption does not necessarily protect data from an identity that can read it through the running system.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.