Data at rest is information stored on persistent media rather than actively moving across a network or being processed. It includes on-premises servers, cloud storage, and off-site backups. section 7.3.1
Protecting stored data requires layered controls: encryption makes it unreadable without decryption keys, access controls restrict retrieval, and integrity checks detect unauthorized changes even after a physical breach. section 7.3.1
Encryption choices and maintenance shape the protection strategy:
- Symmetric encryption uses one key for encryption and decryption. section 7.3.1
- Asymmetric encryption uses public and private keys; the private key decrypts and signs data and remains secret. section 7.3.1
- Encryption algorithms can become obsolete as computational power increases and vulnerabilities are discovered, so protocols require regular review and updating. section 7.3.1
A layered vault
A physical vault illustrates the model: entry rules represent access control, while alarms and cameras represent additional defensive layers. Stored information still needs encryption, monitoring, and ongoing maintenance rather than one-time protection. section 7.0 section 7.3.1
