What is data at rest?

What is data at rest?

Data at rest is data that is stored rather than moving or being processed: files on a laptop SSD, rows in a database, virtual machine disks, backup tapes, USB drives and objects in cloud storage. It is one of three data states. The others are data in transit, which is crossing a network, and data in use, which is loaded in memory and being processed. A single customer record can move through all three in under a second, but each state faces different threats and needs different controls.

The main threats to stored data are physical loss and unauthorized copying: a stolen laptop, a drive pulled from a retired server, a backup copied somewhere it should not be, or a cloud storage bucket left readable by the public.

How data at rest is protected

Encryption is the central control, supported by permissions that decide which accounts can read the data and physical security for the hardware. Storage encryption is usually transparent: once the key is loaded, any authorized process reads plaintext. So the level you encrypt at decides which attacker it stops.

Cloud storage has its own options. The major providers now encrypt stored objects by default with keys they manage. Customers can switch to customer-managed keys in the provider's key management service, or encrypt data before upload so the provider never holds a usable key.

Key management decides whether encryption works

Encrypted data is only as safe as its key. A key stored in plaintext on the same disk, or pasted into a script on the same server, adds little protection. Good practice keeps keys in a TPM, an HSM or a key management service, separates the people who manage keys from the people who manage data, rotates keys on a schedule, and backs up recovery keys. BitLocker recovery passwords, for instance, are commonly escrowed in Active Directory or Microsoft Entra ID so a locked laptop can still be opened. Losing a key with no backup makes the data unrecoverable, which is exactly how cryptographic erase sanitizes a drive on purpose.

Example: matching the control to the threat

A clinic lists three concerns. A nurse might leave a laptop in a car: full-disk encryption with a pre-boot PIN covers it. A contractor with access to the storage share might copy the nightly database backups: TDE or encrypted backup files cover it. Database administrators should not see patients' Social Security numbers: column encryption with keys held outside the database covers it. Full-disk encryption on the database server helps with neither of the last two, because the disk is unlocked whenever the server is running.

Data at rest vs. data in transit vs. data in use

• At rest: stored on media. Threats are theft, copying and exposed storage; controls are storage encryption, permissions and physical security.
• In transit: moving across a network. Threats are sniffing and on-path attacks; controls are TLS, IPsec, SSH and VPNs.
• In use: in RAM or the CPU, usually decrypted. Threats include memory scraping and a compromised operating system or hypervisor; controls include least privilege, endpoint protection, secure enclaves and confidential computing.

Data at rest on the CompTIA Security+ exam

Data states, including data at rest, are part of SY0-801 objective 3.3 on protecting data, and the encryption levels used for stored data are part of objective 1.3 on cryptographic solutions. Scenario wording that points to data at rest: a lost or stolen laptop or phone, a USB drive taken off-site, stolen backups, or a storage bucket found open. The skill tested is picking the level: full disk for a lost device, volume encryption for removable media, file-level for other users of a shared machine, TDE for database files and backups with no application changes, and record or column encryption when administrators must not see certain values. Common distractors are TLS and VPNs, which protect data in transit, and full-disk encryption offered as the fix for an insider on a running server.