Item — HN Reader

Encrypting data while at rest (in storage) as well as in-transit is the way to go. The servers on your infrastructure should be considered hostile at all times.

Put on a hat and pretend you’re a bad actor. Give yourself access to the server where your most important data is stored.

Now look around. Is there anything you can do to extort money?

You could encrypt/destroy the data. (A backup solution saves you here).

You could exfiltrate the data (download or upload to a remote server). What can you do with this data if it was encrypted at rest? Not much.

What else could you do on thisnserver while you have access? This is where things get interesting. Can you force the application to decrypt the data or dump the data somehow? Unlikely, if the cert management is done properly.

The thing is, majority of organisations do not encrypt data at rest. Databases are not encrypted, hard data is not encrypted. If this was not the case, we wouldn’t be hearing about these data leaks.

2 comments

You are emphatically, logically, ethically, technically, securely, and in all other ways correct.

Yes and:

> Encrypting data while at rest (in storage) as well as in-transit is the way to go.

All PII must be encrypted at rest at the field level.

Just like how passwords are properly stored. This is not rocket science.

The book Translucent Databases demonstrates this technique for common use cases. Highest recommendation.

https://www.amazon.com/Translucent-Databases-Peter-Wayner/dp...

> You could exfiltrate the data (download or upload to a remote server). What can you do with this data if it was encrypted at rest? Not much.

How do I encrypt a database at rest? How does it work?

Say, I run a hospital and I want to write patient data to a database. Do I have to decrypt the whole database before I add new data? Each time? Do I also have to decrypt the database each time I query data? How does that work when two doctors want to access the database at the same time?

I assume that constant decryption and encryption of large amount of data adds a significant overhead. So in practice, while data is encrypted at rest, most of the time the data isn't resting, but actively loaded and used and unencrypted.

And now, when a bad actor gets access to that live running database, they can exfiltrate the data.

Please see my sibling comment about Translucent Databases.

Additionally, proper protection of medical records will require globally unique identifiers (aka PID, MRN).

As you know, today, medical record PII must be stored as plaintext to allow record linking across heterogenous orgs. This is bad.