We spend most of our attention
on the wire.
TLS everywhere.
Certificates renewed.
Nobody reads the traffic.
Good.
Then the data lands,
and we stop thinking about it.
It sits in a table
in plain text
for six years.
It sits in a backup
in a bucket
somebody opened up
during an incident
nobody remembers.
It sits in a spreadsheet
on a laptop in a café,
because a report was urgent
and the dashboard was slow.
Most leaks are not interceptions.
They are copies.
Ask one question
of every field you store.
If a stranger read this row,
who gets hurt?
If the answer is nobody,
relax.
If the answer is a person
with a name,
then encryption at rest
stops being a checkbox.
Disk encryption answers
exactly one story:
somebody walks out
with the hardware.
It answers nothing
when the attacker holds your credentials,
because to your credentials
the data is already open.
That is not a reason
to skip it.
It is a reason
to know what it buys.
The real work is smaller
and less satisfying.
Encrypt the columns that matter,
not the whole world.
Hold the keys somewhere
the application can ask
and the database cannot.
Then rotate them,
and find out whether you can.
Half of key management
is discovering
that rotation was never tested.
And look at who can read it.
Not who should.
Who can.
The analytics job
with a full copy.
The support screen
that shows every field
because narrowing it
was a ticket nobody picked up.
Encryption stops the outsider.
Scope stops the accident.
Then do the part
nobody schedules.
Delete things.
The safest record
is the one you no longer keep.
Every export has a lifespan.
Every backup has an end.
Every debugging dump
made at two in the morning
was supposed to be temporary
and is now a permanent liability
with no owner.
Put a date on it.
Let it expire.
Because the reports
almost never say
the encryption was broken.
They say the data was somewhere
nobody remembered
it was.
– Serguey Asael Shinder
Top comments (0)