Encryption in transit and at rest: what to encrypt, where, and who holds the keys

Encryption turns data into something unreadable without a key. It is required by most security standards and data protection laws, and customers increasingly ask about it in due diligence. The two halves are encryption in transit and encryption at rest.

In transit

Data moving across a network should be encrypted everywhere, not only between the customer's browser and your website.

• Websites and APIs: TLS on every page, with HTTP redirected to HTTPS and HSTS enabled.
• Email: TLS between mail servers, and secure protocols (IMAPS, SMTP with STARTTLS) for users.
• Internal traffic: connections from applications to databases, caches and queues, and between data centres. "It is on our private network" is no longer a reason to skip it.
• Administration: SSH, VPN or other encrypted channels only.

At rest

Data stored on disks, in databases and in backups should be encrypted so that a stolen disk, a leaked backup file or a decommissioned drive does not expose it.

• Full-disk or volume encryption on servers.
• Database-level encryption for especially sensitive fields.
• Encrypted backups, with the keys stored separately from the backups themselves.

Keys are the hard part

Encryption is only as strong as the protection of its keys.

• Store keys separately from the data they protect.
• Restrict who and what can use them, and log every use.
• Rotate keys on a schedule and immediately after any suspected exposure.
• Plan for loss. An encrypted backup whose key is lost is the same as no backup.

Keep algorithms current

Retire old protocols such as TLS 1.0 and 1.1 and weak ciphers. Keep your software updated so improvements, such as the post-quantum hybrid key exchange now arriving in TLS libraries, reach you automatically.

How IDX helps

Hosting on IDX includes free SSL certificates that renew automatically. Our Data Backup service stores encrypted, versioned backups in a separate region. On dedicated servers and Egypt Servers, our team can set up disk encryption, encrypted internal connections and key handling to match your compliance requirements.