# Database Encryption: What Are At Rest, In Transit and TDE? **URL:** https://securesys.com.tr/en/learning/database-security/database-encryption-at-rest-in-transit-tde ![Database Encryption: What Are At Rest, In Transit and TDE?](/images/bilgi-merkezi/covers/cover-veritabani-05.webp) In database security, another subject as important as access control is the encryption of the data. Because however well a database is authorized; a disk can be stolen, a backup file can be copied, network traffic can be intercepted, a storage snapshot can be seized, cloud storage can be misconfigured or the encryption key can be protected wrongly. For this reason, in database security, critical data must be protected not only with access control but also with cryptographic methods. This approach is generally expressed as: #### Database Encryption in security terminology. Database encryption is not a single technology. In corporate structures encryption can be applied at different layers: #### Encryption at Rest #### Encryption in Transit #### Transparent Data Encryption – TDE #### Column-Level Encryption #### Field-Level Encryption #### Backup Encryption #### Key Management Each of these layers provides protection against a different risk. The most important point is this: **A database being encrypted does not mean it is protected against every attack scenario.** For example, TDE may be active, but if the authorized DBA account is compromised the attacker can read the data inside the database with normal queries. For this reason encryption must always be designed together with; authentication, authorization, least privilege, audit, key management as its companions. ### What Is Database Encryption? Database Encryption is the protection of the data in the database with cryptographic methods so as to make it harder for unauthorized people to read it. The purpose is to protect the data; on disk, in the backup, over the network, and in some cases at the column or field level as its scope. ### Why Is Encryption Necessary? Inside a database there is most often; personal data, customer information, financial records, identity information, trade secrets, payment data as its content. Keeping this data in the clear can increase the impact of a data breach. ### Does Encryption Provide Confidentiality? Yes. Encryption is predominantly a: #### Confidentiality control. However, on its own it provides neither integrity nor availability. ### Which Risks Does Database Encryption Protect Against? For example; disk theft, seizure of the backup file, a storage snapshot leak, network sniffing, cloud storage exposure it can reduce risks such as these. ### Which Risks Is Encryption Not Sufficient Against? For example; compromise of an authorized DBA account, SQL Injection, a malicious insider, compromise of the application account in these cases the attacker can read the data normally through the application or the database. For this reason encryption is not sufficient on its own. ### What Is Encryption at Rest? Encryption at Rest is the encryption of the data stored on disk. This data; the database file, data files, the transaction log, the storage volume, the backup can be any of these. ### What Does At-Rest Encryption Provide? It makes reading the data directly harder even if the storage is physically seized. For example, when the disk is attached to another server the database file can be encrypted. ### Are Disk Encryption and Database Encryption the Same? No. Disk encryption can work at the whole disk or volume level. Database encryption, meanwhile, can be applied at the DBMS level. ### What Is Full Disk Encryption? It encrypts all the data on the disk. For example, the operating system and the database files can be protected by the same encryption layer. ### Is Full Disk Encryption Enough for a Database? Not always. While the server is running the disk is in an unlocked state. An authorized user can reach the database files. For this reason database-specific encryption can provide additional protection. ### What Is Transparent Data Encryption – TDE? TDE means: #### Transparent Data Encryption that is: #### encryption transparent to the application in plain terms. It is the mechanism used to encrypt the database's physical data files. ### Why Is TDE Called Transparent? Because the application most often does not notice the encryption process. The application sends a normal SQL query. The database reads the data encrypted from disk, processes it in memory and returns the normal result to the application. ### Which Data Does TDE Encrypt? It can vary according to the platform. It generally protects physical database files such as; the database data file, the transaction log as its scope. ### Does TDE Encrypt the Backup Too? It depends on the platform and the backup method used. On some systems the backups associated with TDE can be encrypted. However, backup encryption must be verified separately. ### Does TDE Hide the Data from the Database Administrator? No. This is one of the most important subjects. TDE protects the data on disk. When an authorized database user runs a: SELECT query, they can read the data. ### Does TDE Protect Against a DBA Compromise? On its own, no. If the DBA credential is compromised the attacker can reach the data through normal database queries. ### When Is TDE Useful? It is useful particularly in; disk theft, storage access, database file copying, backup media exposure risks such as these. ### What Is Column-Level Encryption? It is the additional encryption of specific database columns. For example; national ID numbers, IBANs, credit card numbers, health data sensitive fields such as these can be encrypted. ### Is Column Encryption Different from TDE? Yes. While TDE works at the whole database file level, column encryption protects specific data fields. ### What Does Column Encryption Provide? It enables specific columns to be protected with a separate encryption key even if the database file is open. ### Can the DBA See the Data with Column Encryption? This depends on the architecture used. If the encryption key is kept outside the database, the DBA may not be able to see the plaintext data directly. ### What Is Application-Level Encryption? It is the data being encrypted by the application before it is sent to the database. The database stores only ciphertext. ### What Is the Advantage of Application-Level Encryption? It can limit the database administrator's ability to see the plaintext data. The encryption key can be held in the application or in a separate key management system. ### What Is the Disadvantage of Application-Level Encryption? It can make query and search operations harder. For example, on an encrypted column; LIKE, range search, sorting operations such as these can become difficult. ### What Is Field-Level Encryption? It is the additional encryption of specific data fields inside the application. For example, only a certain part of the customer's card number can be kept under encryption. ### Are Field-Level Encryption and Column-Level Encryption the Same? The concepts can be used similarly in some architectures. However, field-level encryption is most often applied to specific data fields at the application layer. ### What Is Cell-Level Encryption? It is the encryption of specific cells or data values inside the database. This concept can be used on some DBMS platforms. ### What Is Encryption in Transit? It is the encryption of the data moving between the client and the database. The most widespread method is: #### TLS using this protocol. ### Why Must Database Traffic Be Encrypted? Over the network; usernames, queries, results, personal data can be carried. Without encryption, network traffic can be intercepted. ### What Is TLS? TLS is: #### Transport Layer Security the security protocol enabling network traffic to be encrypted and the parties to be verified. ### Are SSL and TLS the Same? In daily use the term SSL can still be used. However, on modern systems the secure protocol is TLS. Old SSL versions must not be used. ### What Does Database TLS Provide? For the traffic between the client and the database it supports; confidentiality, integrity and, with appropriate configuration, server authentication as its properties. ### Is TLS Only Necessary on Internet Traffic? No. The internal network must not be considered entirely trusted either. Database traffic can be encrypted on the internal network too. ### Why Is the Internal Network Not Trusted? If an endpoint is compromised the attacker can try to intercept traffic on the internal network. The Zero Trust approach therefore does not consider the internal network automatically trusted. ### What Is a TLS Certificate? It is the digital certificate used to verify the database server's identity. ### Can a Client Certificate Be Used? Yes. In architectures using Mutual TLS – mTLS the client can also be verified with a certificate. ### What Is mTLS? Mutual TLS is both the server and the client verifying each other with certificates. ### Is mTLS Advantageous for Databases? It can provide strong authentication on critical service-to-service connections. ### Why Is Certificate Validation Important? Even if encryption is on, if the client does not perform certificate validation, man-in-the-middle risks can arise. ### Should Certificate Expiry Be Monitored? Yes. An expired database certificate can create an application outage. ### What Is Certificate Rotation? It is replacing the certificate with a new one before it expires. This process can be automated. ### Why Must Old TLS Versions Be Disabled? Old protocols can have known cryptographic weaknesses. According to the security baseline, modern TLS versions must be preferred. ### What Is a Weak Cipher? They are old or weak encryption algorithms that do not meet the modern security level. ### What Is a Cipher Suite? It is the combination of the; key exchange, encryption, integrity algorithms to be used in a TLS connection. ### What Is a Database Encryption Key? It is the cryptographic key used to encrypt the data and to decrypt it when needed. ### Are an Encryption Key and a Password the Same? No. A password is used for user authentication. An encryption key protects the data cryptographically. ### Why Can Key Management Be More Critical Than Encryption? Because if the encryption key is seized, the encrypted data can be decrypted. For this reason; **key management must be as strong as the encryption itself.** ### Where Should the Encryption Key Be Stored? As far as possible it must not be kept in the clear in the same place as the database data. Among the systems that can be used; a KMS, an HSM, a secure vault may be found. ### What Is a KMS? KMS is: #### Key Management Service which enables encryption keys to be created, stored and managed centrally. ### What Is an HSM? HSM is: #### Hardware Security Module which enables cryptographic keys to be held on secure hardware and cryptographic operations to be performed in a secure environment. ### Are a KMS and an HSM the Same? Not exactly. A KMS is a key management service. An HSM, meanwhile, provides hardware-based protection of the keys. Some KMS systems can use an HSM in the background. ### What Is Key Rotation? It is the encryption key being changed according to defined policy or risk conditions. ### Why Is Key Rotation Done? It can reduce the risk of a key being used for many years. It can also be applied because of compliance or security policy. ### Can Key Rotation Lead to Data Loss? If done wrongly, yes. If old data is still encrypted with the old key, deleting the key can make the data unrecoverable. ### Should the Old Encryption Key Be Deleted? It must be managed according to retention and recovery needs. The old key may be needed so that old backups can be restored. ### Is a Key Backup Necessary? Yes. If the encryption key is lost, even the backup data can become unusable. ### How Should the Encryption Key Backup Be Protected? It must be kept separately from the normal database backup and under very strict security. ### What Is Key Escrow? It is the encryption key being protected separately with a trusted recovery mechanism. ### Should the Encryption Key Be Stored in the Same Place as the Backup? As far as possible, no. If the backup and the key are seized in the same environment, the encryption protection weakens. ### What Is Database Backup Encryption? It is the additional encryption of the backup file. ### Why Is Backup Encryption Critical? A backup most often contains a full copy of the production database. For this reason a backup leak can be as serious as a production database breach. ### Where Can the Backup File Be at Risk? For example; on a NAS, on object storage, on tape, on cloud storage, on an external disk, at the DR site it can reside in any of these. ### Should the Backup Also Be Encrypted During Transfer? Yes. If the backup traffic is carried over the network, encryption in transit must be used. ### Does Backup Compression Replace Encryption? No. Compression reduces the size of the data. Encryption prevents the data from being read. ### Is Using a Backup Password Enough? Strong cryptographic encryption and key management must be used. Simple password protection may not be sufficient. ### Are Immutable Backup and Encryption the Same? No. Immutable backup makes deleting or modifying the data harder. Encryption, meanwhile, prevents the data from being read. ### Should Immutable and Encrypted Backup Be Used Together? On critical systems, yes. These two controls provide protection against different threats. ### Is Encryption Necessary for Air-Gap Backup? Yes. Being offline does not automatically provide data confidentiality. Tape can be stolen. For this reason offline backups can be encrypted too. ### Should Database Snapshots Be Encrypted? Yes. A snapshot can contain production database data. Encryption must be checked on cloud or storage snapshots. ### What Is Cloud Database Encryption? In cloud managed database services, at-rest encryption is most often supported. However, the customer; key management, IAM, backup encryption, network encryption must assess these subjects separately. ### What Is a Provider-Managed Key? It is the model in which the cloud provider manages the encryption key. ### What Is a Customer-Managed Key? It is the model in which encryption key management is under the customer's control. It is generally expressed as CMK. ### What Is the Advantage of a Customer-Managed Key? The organization; key lifecycle, rotation, revocation, access policy can hold more control over these. ### Is There a Disadvantage to a Customer-Managed Key? Yes. It brings more operational responsibility. A wrong key deletion or policy change can lead to a service outage. ### What Is Bring Your Own Key – BYOK? It is the approach of the organization using an encryption key it created itself in a cloud service. ### What Is Hold Your Own Key – HYOK? It is the stricter model in which the key is kept under the organization's control outside the cloud provider. It may not be supported by every service. ### If a Cloud Snapshot Is Copied to Another Account, What Happens to the Key? Depending on the architecture, key permissions must be managed separately. Even if the backup has been copied, a restore may not be possible without access to the encryption key. ### How Should Cross-Account Backup Encryption Be Designed? The backup account and the encryption key privileges can be separated from the production account. This reduces the blast radius. ### Should the Key Administrator and the Database Administrator Be Separated? On critical systems it can be evaluated. This provides Separation of Duties. ### What Is the Risk If the DBA Is Also the Key Administrator? The DBA can hold full access both to the data and to the encryption key. For this reason separation of duties is important for critical data. ### What Is Cryptographic Separation of Duties? It is the person managing the database being different from the person doing key management. ### Who Should Reach the Application Encryption Key? Only the relevant application or the authorized cryptographic service must reach it. ### Should Developers See the Encryption Key? Production encryption keys must, as far as possible, not be open to direct developer access. ### Is Keeping the Key Inside the Source Code Safe? No. It is one of the most serious secret management mistakes. ### What Happens If an Encryption Key Is Found Inside a Git Repository? Everyone with repository access can see the key. In a repository compromise the encrypted data comes under risk. ### Can the Key Be Kept in an Environment Variable? Although it is used in some architectures, in environments requiring high security a dedicated secret management can be preferred. ### What Is the Difference Between a Secret Manager and a KMS? A secret manager; passwords, API keys, credentials is used for storing these. A KMS, meanwhile, focuses on cryptographic key lifecycle management. ### Does Database Encryption Affect Performance? Yes. Encryption requires cryptographic operations. However, on modern hardware and DBMS systems the effect is manageable in most scenarios. ### How Much Does TDE Affect Performance? It varies according to the platform, the workload and the hardware. For this reason a benchmark must be performed before production. ### Can Column Encryption Affect Performance More? Yes. It can affect; search, sorting, index behaviour in particular. ### Can an Encrypted Column Be Indexed? It depends on the encryption method used. With some encryption types, normal index usage can become difficult. ### What Is Deterministic Encryption? The same plaintext always turns into the same ciphertext. This can make equality search easier. ### What Is the Risk of Deterministic Encryption? The same values producing the same ciphertext can increase pattern analysis risk. ### What Is Randomized Encryption? The same plaintext can produce different ciphertext in each encryption operation. This increases pattern confidentiality. ### Does Randomized Encryption Make Queries Harder? Yes. Equality search and indexing can become more difficult. ### What Is Tokenization? It is replacing sensitive data with a meaningless token instead of the real value. The real data can be held in a separate secure system. ### Is Tokenization Encryption? No. Encryption is a mathematically reversible cryptographic operation. Tokenization is a different data protection approach. ### When Is Tokenization Used? For example, it can be used to reduce payment card data being held directly in application systems. ### What Is Hashing? It is the transformation of data into a different value through a one-way mathematical function. ### Are Hashing and Encryption the Same? No. Encryption can be reversed. Hashing is ideally one-way. ### Should Passwords Be Encrypted in the Database? Passwords must be protected with secure password hashing algorithms rather than reversible encryption. ### Why Is Password Hashing Different? The application has no need to know the user's real password again. It only needs to verify it. ### What Is a Salt? It is the unique random value added to a password hash. It ensures the same passwords produce different hashes. ### Why Is Keeping Database Passwords in Plaintext a Critical Risk? In a database leak all the user passwords can be obtained directly. ### When Should Personal Data Encryption Be Used? It must be determined according to risk analysis and data classification. Not every column carries the same sensitivity. ### How Does Data Classification Affect the Encryption Policy? For example; Public → Encryption optional according to architecture Internal → Standard encryption Confidential → Strong encryption Restricted → Field-level encryption + strict key management a model along these lines can be built. ### What Is an Encryption Policy? It defines which data will be encrypted with which technology and under which key management model. ### What Should an Encryption Policy Include? For example; data classification, approved algorithms, TLS requirements, key lifecycle, backup encryption, key ownership, key rotation, certificate management can be defined. ### What Is an Approved Cryptographic Algorithm? They are the encryption algorithms permitted for use in the organization's security standard. ### Should We Write Our Own Encryption Algorithm? Generally no. Standard, tested and widely accepted cryptographic methods must be used. ### Why Is Custom Cryptography Risky? Cryptographic design errors can easily weaken systems that look secure. ### Are the Encryption Algorithm and the Key Length the Same Thing? No. The algorithm expresses the cryptographic method used. The key length, meanwhile, expresses the size of the key. ### Is Key Length Alone an Indicator of Security? No. Algorithm design, implementation and key management matter too. ### Is Database Encryption Logging Necessary? Yes. Key access and key management operations must be audited. ### Should KMS Logs Be Sent to SIEM? In critical environments, yes. ### Which Key Events Should Be Monitored? For example; key created, key disabled, key deleted, key policy changed, key access denied, unusual key usage can be monitored. ### Should an Alarm Be Generated If an Encryption Key Is Deleted? Absolutely. Key deletion is a very critical event. ### Why Does Key Deletion Carry a Ransomware Risk? Without deleting the data, an attacker can also make the system unusable by disabling the encryption key. ### What Is Crypto-Shredding? It is the encryption key being securely destroyed so that the encrypted data becomes practically unreachable. ### Can Crypto-Shredding Be Used for Data Deletion? In some architectures, yes. However, it must be assessed according to legal and technical requirements. ### Why Is Encryption Key Availability Important? Key management is critical not only for confidentiality but also for availability. If the key is unreachable, the database may not open. ### Does the Database Run If the KMS Goes Down? It depends on the architecture and the key caching behaviour. For this reason KMS availability must be designed separately. ### Is KMS High Availability Necessary? For critical databases, yes. ### Is an HSM Failure Recovery Plan Necessary? Yes. So that keys are not lost in an HSM failure, redundancy and a recovery plan must exist. ### What Is the Encryption Key DR Plan? It is the necessary keys and certificates being securely accessible so that the DR environment can open the production encrypted database. ### What Happens If There Is No Key at the DR Site? The database backup can be restored but without the encryption key the data may be unusable. ### Should the Encryption Key Be Tested in the Backup Restore Test Too? Absolutely. A real restore test must verify not only the backup file but the key recovery process as well. ### Can the RTO Change After Encryption? Yes. Key recovery, certificate or KMS dependencies can increase the restore time. ### Is There a Direct Relationship Between Encryption and RPO? Encryption does not directly determine the RPO. However, backup and replication processes need to work consistently with encryption. ### Should Database Replication Be Encrypted? Yes. The traffic between primary and replica can carry sensitive data. ### Should the Replication Channel Use TLS? On systems where it is possible, yes. ### Should Log Shipping Be Encrypted? Sensitive database changes can be inside the transaction log. Transfer and storage security must be provided. ### Should Database Exports Be Encrypted? Yes. CSV, dump or export files can move outside the database security boundary. ### Should a CSV File Be Sent Without Encryption? If it contains sensitive data it can create serious risk. Secure transfer and encryption must be used. ### Why Is a Database Dump So Sensitive? A database dump can contain millions of records in a single file. ### Should a Database Dump Be Left as a Temporary File? No. Temporary exports must be removed securely after the operation. ### What Is Temporary File Encryption? It is the temporary files created during database operations also being protected within the scope of encryption. ### Can Plaintext Data Be Present in Swap and Memory? Yes. Database data can be in plaintext in memory during processing. For this reason host security matters too. ### Does Encryption Protect Data in Use? Classic at-rest and in-transit encryption is not sufficient for data in use. ### What Is Data in Use? It is data actively being processed in the CPU or in memory. ### What Is Confidential Computing? On some modern platforms these are the technologies aiming to protect data in use with mechanisms such as a trusted execution environment. ### Does Database Encryption Fully Prevent Insider Threat? No. If an authorized user can reach the plaintext, insider threat continues. ### What Should Be Added for Insider Threat? Alongside encryption; RBAC, PAM, DAM, audit, DLP, UEBA can be used. ### Does Database Activity Monitoring Complement Encryption? Yes. Encryption protects the data. DAM, meanwhile, can monitor the behaviour of users reaching the plaintext data. ### Can Encryption and Data Masking Be Used Together? Yes. Encryption provides storage security. Masking can limit the data the user sees. ### Can Encryption and Tokenization Be Used Together? Yes. On very sensitive payment or identity data in particular, different layers can be applied together. ### Database Encryption and KVKK In ensuring the security of personal data, encryption is one of the important technical measures. However, it is not sufficient on its own. It must be addressed together with access control, logging and the data lifecycle. ### Does Encryption Automatically Provide KVKK Compliance? No. Encryption is an important security control but on its own it does not provide regulatory compliance. ### Database Encryption and ISO/IEC 27001 Within the ISO/IEC 27001 risk-based information security approach, cryptography and key management are important security areas. Organizations must determine which data will be protected with which cryptographic control according to a risk assessment. ### Database Encryption and PCI DSS In protecting card data, strong cryptography, key management and access control carry critical importance. ### The Relationship Between Database Encryption and Backup Retention Backups kept for a long time can depend on old encryption keys. For this reason the key lifecycle must be planned consistently with the backup retention period. ### If a Seven-Year Backup Is Kept, What Should Happen to the Key? If the backup is to be restored seven years later, the necessary key must be securely accessible as well. ### Does Key Rotation Break Old Backups? If designed correctly it must not. However, deleting the old key too early can make the restore impossible. ### What Is a Database Encryption Assessment? It is the systematic examination of the organization's database encryption position. ### What Should an Encryption Assessment Check? For example: Which databases are encrypted? Is TDE active? Is TLS mandatory? Is the backup encrypted? Where is the key kept? Who can reach the key? Is there key rotation? Has key recovery been tested? ### What Is the Encryption Coverage KPI? It shows how many of the critical databases are protected with encryption. ### What Is the TLS Coverage KPI? It can measure how many of the database connections use encrypted transport. ### What Is Backup Encryption Coverage? It shows how many of the backups are cryptographically protected. ### What Is KMS Audit Coverage? It measures how many of the encryption key operations are audited. ### A Sample Architecture for Database Encryption A modern architecture can be thought of as follows: #### Application ↓ #### TLS / mTLS ↓ #### Database Authentication ↓ #### RBAC / Least Privilege ↓ #### Encrypted Database – TDE ↓ #### Sensitive Column Encryption ↓ #### Central KMS / HSM ↓ #### Encrypted Backup ↓ #### Immutable Backup Storage Here a single encryption layer is not relied upon. ### The Defense in Depth Encryption Model For example: The laptop was stolen → Disk Encryption The network was intercepted → TLS The database file was stolen → TDE A sensitive column was opened → Column Encryption The backup was stolen → Backup Encryption Someone tried to reach the key → KMS/HSM + Audit This approach limits different attack paths separately. ### The Most Common Mistakes in Database Encryption The mistakes frequently seen in organizations are as follows: - Using only disk encryption and assuming the database is fully secure - Thinking TDE hides the data from the DBA - Not using TLS on database connections - Not performing certificate validation - Leaving old TLS protocols enabled - Storing the encryption key in a plain file on the database server - Putting the key into the source code - Not performing key rotation - Not creating a key backup and recovery plan - Keeping backups unencrypted - Leaving export files in plaintext while production is encrypted - Not checking cloud snapshot encryption - Not monitoring KMS logs - Unnecessarily combining the key administrator and DBA roles - Not testing encryption key recovery in the restore test ### Database Encryption Checklist A corporate checklist can include these headings: - Has data classification been completed? - Is there at-rest encryption on critical databases? - Is TDE active? - Is TLS mandatory? - Are old protocols disabled? - Is certificate validation performed? - Are sensitive columns protected additionally? - Is the backup encrypted? - Is the snapshot encrypted? - Are export files protected? - Is replication traffic encrypted? - Is a KMS/HSM in use? - Is key access restricted? - Is there a key rotation policy? - Is there a key backup? - Has key recovery been tested? - Are KMS events audited? - Has key access been tested in the DR environment? ### Questions Management Should Ask About Database Encryption Management or IT leaders must be able to get answers to these questions: How many of our critical databases are encrypted? Are our backups encrypted? Is all database traffic over TLS? Where are the encryption keys kept? Who can reach the encryption keys? Is the DBA fully privileged over both the database and the key? Is KMS access logged? If the key is lost, can we bring the database back? When was the last encrypted restore test performed? These questions show the database encryption maturity level. ### Frequently Asked Questions #### What is database encryption? It is the protection of the data in the database against unauthorized access with cryptographic methods. #### What is Encryption at Rest? It is the encryption of database data sitting on disk or storage. #### What is Encryption in Transit? It is the encryption of data moving between the client and the database with methods such as TLS. #### What is TDE? It is the mechanism enabling database data files to be encrypted transparently. #### If TDE is turned on, can the DBA not see the data? No. An authorized DBA can read the plaintext data with normal database queries. #### What is Column-Level Encryption? It is the additional encryption of specific sensitive database columns. #### Should the database backup be encrypted? Yes. The backup can contain a full copy of the production data. #### Where should the encryption key be kept? As far as possible it must be managed in a separate and secure KMS, HSM or key vault infrastructure. #### What is key rotation? It is the controlled renewal of the encryption key. #### Does encryption prevent SQL Injection? No. SQL Injection relates to application and authorization security. Encryption can limit some data access paths of the attack but it does not eliminate SQL Injection. ### Conclusion: An Encrypted Database Is Not Always a Secure Database Database encryption is one of the fundamental layers of modern data security. However, the biggest mistake made around encryption is the: **“The database is encrypted, we are safe now.”** approach. In reality different encryption controls reduce different risks. #### Encryption at Rest protects the data on disk. #### TLS protects the data on the network. #### TDE protects the database files. #### Column-Level Encryption provides additional protection for critical data fields. #### Backup Encryption protects the recovery copies. #### KMS and HSM meanwhile, provide secure management of the encryption keys. However, if an authorized user can read the data normally once connected to the database, encryption on its own does not solve the insider threat or credential compromise problem. For this reason a strong database encryption architecture must be used together with these controls: #### RBAC #### Least Privilege #### PAM #### Audit #### DAM #### SIEM #### Backup Security #### Key Management One of the most important principles is this: **The encryption key is an asset at least as critical as the data it encrypts.** Because if the key is lost the organization may be unable to reach its own data. If the key is seized the attacker can read the encrypted data. For this reason a corporate database encryption strategy must be able to answer not only: **“Is the data encrypted?”** as the question; **“Which data is encrypted, with which key, who manages that key, who can reach it and what will we do if the key is lost?”** but these questions as well. Real database encryption security emerges when: **Data Protection + Key Protection + Access Control + Audit** are designed together.