Data at rest is information stored on persistent or nonvolatile media rather than actively transmitted. Without protection, unauthorized parties may read or alter it, causing theft, corruption, legal exposure, and reputational damage. section 8.4 section 8.4.1
Protecting stored data requires more than encrypting a database:
- Encrypt sensitive values before storing them, then decrypt them only for authorized use. section 8.4.2
- Combine encryption with access controls, secure backups, audits, user education, key rotation, and input validation. section 8.4.1
Encrypting a value before database storage
A Python application can use the cryptography library's Fernet implementation to generate a key, encrypt plaintext into ciphertext, store the ciphertext as a database BLOB, and decrypt it after retrieval. A SQLite3 example demonstrates this flow, while production systems should use dedicated ORM support and secure key management.
