Encryption at rest
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
protect stored data at the right layer.
Planned topics
- Layers: disk or volume encryption (provider default), database encryption, application-level (column) encryption.
- Disk encryption protects lost disks, not a compromised application or SQL user.
- Encrypt sensitive fields (phone numbers, national IDs) in the application when the database admin must not read them.
- Trade-off: encrypted columns cannot be searched or sorted directly; use deterministic encryption or a blind index only when needed.
Draft outline details
Demonstration
customers.phone_enc stored as ciphertext with a key ID; searching by hashed phone_idx (blind index).
Check your understanding
What does disk encryption not protect against?
Show answer
A compromised application or database account that reads data normally.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.