Encryption: Data at Rest and Data in Transit

The process of encrypting data when it is stored or saved in a storage device or server to protect it from unauthorized access.

Data encryption at rest

The key used to encrypt and decrypt data at rest. If obtained by an attacker, it can be used to access and modify the data.

Data encryption key (DEK)

An asymmetric encryption key used to encrypt the DEK. It helps protect the DEK and is stored in a key management server (KMS).

Key encryption key (KEK)

A server that stores and manages encryption keys, including the encrypted DEK. It grants access to the DEK based on the validity of the KEK.

Key management server (KMS)

The process of encrypting data when it is being transmitted or sent over a network to protect it from unauthorized interception or manipulation.

Encryption of data in transit

Another term for data in transit, referring to data that is being transmitted or sent over a network.

Data in flight

A network connection that connects different locations or networks over a wide geographic area, such as the connection between private and public clouds in a hybrid cloud environment.

Wide area network (WAN) link