Encryption in transit and at rest

Backend security Mid-level Python 3.13+ PostgreSQL 17+ Reviewed 31 Oct 2026 By Best Latest Apps

Pick the fix

An attacker steals a valid database login. Which control still keeps card numbers unreadable?

OptionsApplication-level encryption with keys held in a KMS the attacker can't reachDisk encryptionTLS to the databaseBackups to another region

Hint 1 of 1

Who decrypts disk encryption?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Application-level encryption with keys held in a KMS the attacker can't reach

Correct. The database only stores ciphertext.

Disk encryption and TLS protect data at rest and in transit, but a valid login reads plain values. Encrypting fields in the app with keys in a KMS means the database only ever returns ciphertext.

Why not the others?

B Disk encryption. The database decrypts for any valid login.
C TLS to the database. Protects the wire, not the data the login can query.
D Backups to another region. Unrelated to reading data.

30-second answer

TLS encrypts and authenticates the connection: the client checks the server's certificate chain and hostname, and nobody on the path can read or alter traffic. Use TLS 1.2 or 1.3 everywhere, including inside your network. Encryption at rest protects disks and backups if the media is stolen, but the running database decrypts for anyone with a valid login, so it doesn't stop application-level breaches. For especially sensitive fields add application-level encryption with keys in a KMS.

Practise saying it · 30 s. No recording, just a timer

TLS vs at rest.

Say your answer out loud, then check which of these points you covered:

TLS: wire, cert + hostname
At rest: stolen media
Field-level + KMS
HSTS, automated certs

Deep dive

TLS 1.3 removes older cipher suites and needs one round trip for the handshake.

HSTS tells browsers to use HTTPS only.

Automate certificates (ACME / Let's Encrypt) to avoid expiry outages.

Field-level encryption makes those fields hard to search or index.

Common mistakes

Plain HTTP between internal services.
Disabling certificate verification in clients 'temporarily'.
Treating at-rest encryption as protection against SQL injection.

Senior take & follow-ups

Separate what each layer protects, then add field-level encryption and certificate hygiene.

Follow-up questions

Think of your answer first, then open the hint.

Does at-rest encryption stop a stolen DB password?
Show hint
No; queries see plaintext.
What's envelope encryption?
Show hint
A KMS master key wraps per-object data keys.

Similar on iOS: End-to-end encryption in a chat app The iOS page encrypts messages so even the server can't read them; here the server encrypts for transport and storage.

Suggest a fix if something here is wrong or out of date.