Data at rest discussion

Question

Hello, I am looking for clarification or expert advice regarding data at rest. I believe I understand the meaning but when it applies to an SQL database how are we to determine what is at rest. Would it be advised to encrypt all data on the database whether in use or at rest?
Thank you

Answer 1

"at rest" means files on the hard drive.

If someone has access to the hard drive, they could see the data and/or copy the files to another location. If your servers are secure, and there is not a regulatory reason, I would not recommend it.

See:
https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/security/transparent-data-encryption#transparent-data-encryption-tde

Answer 2

Thank you for the quick response.
My impression is that since the SQL database is always in use and never at rest (unless on the weekends when no one is accessing it) why implement encryption. I thought it would be required for archived data for example. Difficult to determine what could be at rest at times. If there was a compromise and someone copies the database to another location. They would still need the SA login to see the data.
What do you think?

Answer 3

"at rest" does not mean "idle". In this context, it means data stored on the hard drive or other media.

There are several industries, which require all or some data stored on the hard drive to be encrypted. That way if someone accesses the physical hardware, the data is still encrypted. It also hides the data from "server admins".

Answer 4

I see, so in my case I have an sql server housed at a server farm. The hardware belongs to this third party vendor and they have access to it physically.
Would the data still need to be encrypted in your opinion?
Thank you

Answer 5

in my case I have an sql server housed at a server farm. The hardware belongs to this third party vendor and they have access to it physically.
Would the data still need to be encrypted in your opinion?

This is all the more reason to encrypt data at rest. Consider the storage will eventually reach end-of-life. Storage encryption will provide an extra measure of data protection should the hardware not be properly disposed.