4 ms·

Thanks @boulos. Appreciate it. I'm unclear on what encrypted at rest means. For example - I'd expect the data in Google cloud store to be encrypted (or have an

by kkotak 9y ago

Thanks @boulos. Appreciate it. I'm unclear on what encrypted at rest means. For example - I'd expect the data in Google cloud store to be encrypted (or have an option to be encrypted) so that if someone were to get access to our DB admin account, they won't be able to see the JSON data in plain text. The only way to see the data would be through API access which can be configured for ACL (and by Google cloud store so we can index and query data which is encrypted at rest).

kdecline 9y ago
encrypted at rest here means that any data sitting on disk is encrypted. Probably ACLed to the service requiring it. For example, when bigquery writes to disk, it gets encrypted with a key that BQ only has access to.
boulos 9y ago
Encryption at rest [1] protects against someone who has access to the encrypted bytes from not being able to decrypt it. That is, if someone got the raw bytes off our storage somehow, it's not useful to them. If someone has access to your account, then the storage system can't tell if it's you or not. Data in Datastore (and Firestore fwiw, that needs an update) is encrypted at rest, and today's paper discusses how it's also encrypted in transit between your app and the service. I don't believe Datastore supports Customer Supplied Encryption Keys [2] (yet) but that lets you have a key that even Google can't decrypt the data without you providing it. That's a pretty good way to separate permission from keys. Disclosure: I work on Google Cloud. [1] https://cloud.google.com/security/encryption-at-rest/default-encryption/ https://cloud.google.com/security/encryption-at-rest/default... [2] https://cloud.google.com/security/encryption-at-rest/customer-supplied-encryption-keys/ https://cloud.google.com/security/encryption-at-rest/custome...

4 ms·

Thanks @boulos. Appreciate it. I'm unclear on what encrypted at rest means. For example - I'd expect the data in Google cloud store to be encrypted (or have an

by kkotak 9y ago

kdecline 9y ago
encrypted at rest here means that any data sitting on disk is encrypted. Probably ACLed to the service requiring it. For example, when bigquery writes to disk, it gets encrypted with a key that BQ only has access to.
boulos 9y ago
Encryption at rest [1] protects against someone who has access to the encrypted bytes from not being able to decrypt it. That is, if someone got the raw bytes off our storage somehow, it's not useful to them. If someone has access to your account, then the storage system can't tell if it's you or not. Data in Datastore (and Firestore fwiw, that needs an update) is encrypted at rest, and today's paper discusses how it's also encrypted in transit between your app and the service. I don't believe Datastore supports Customer Supplied Encryption Keys [2] (yet) but that lets you have a key that even Google can't decrypt the data without you providing it. That's a pretty good way to separate permission from keys. Disclosure: I work on Google Cloud. [1] https://cloud.google.com/security/encryption-at-rest/default-encryption/ https://cloud.google.com/security/encryption-at-rest/default... [2] https://cloud.google.com/security/encryption-at-rest/customer-supplied-encryption-keys/ https://cloud.google.com/security/encryption-at-rest/custome...