Cloud security basics · Lesson 6 of 6
Protect the keys behind encrypted data
“Encrypted at rest” describes a protection for stored data. It does not mean every user, application, or stolen session is prevented from reading that data.
Trace the authorized read
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- A role requests data
The reporting application asks for an export using its identity.
- Evaluate access
The service checks effective permissions. Key-use authorization may be mediated by the service, depending on its design.
- Decrypt if authorized
With the required access, the service can decrypt stored data. The storage is still encrypted at rest.
- Readable data returns
A compromised authorized role may use this same path. Protect role access as well as stored data and keys.
Check both sides of encryption
Compare the parts before making a security decision.
- Stored data
Ciphertext limits exposure of readable stored content.
- Authorized route
A service may return plaintext to a permitted identity.
- Access review
Check who can use the data and key path, not just the encryption setting.
Read the visualWhy can a compromised application role still threaten encrypted cloud data?
At-rest encryption and access control solve related but different problems. Review the actual authorized read path.
Separate storage from key access
Understand where encryption keys are managed and which identities may use them. Avoid placing an exposed key beside the ciphertext it protects.
Check the full read path
A cloud service may decrypt data transparently for an authorized request. Review effective access to data and keys, including how the service uses keys on a caller’s behalf.
Plan changes and recovery
Coordinate key rotation, access changes, retention, and recovery with the owner. Removing or deleting the only usable key can make important data unrecoverable.
Put it in context
A fictional report service can read encrypted exports through an approved role. If that role is compromised, encryption at rest may not stop reads through the same authorized path. The investigation must examine role activity and effective permissions.
Encryption helps protect data, but the authorized route to decryption needs protection too.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.