3 ms·
With encryption at rest, you can basically make sure data can only be accessed from the main interface. Otherwise there are multiple ways to let data leak, e.g.
by azurezyq 8y ago
With encryption at rest, you can basically make sure data can only be accessed from the main interface. Otherwise there are multiple ways to let data leak, e.g., sys admins, decommissioned disks, or other tools.
- ec109685 8y agoSys admins would have access regardless if they were evil enough.
- smueller1234 8y agoIt's entirely feasible to mitigate a lot of that insider risk. You have to pick the convenience/risk reduction trade off, though. For example, it may make sense to disallow any unilateral access, and only allow signed, reviewed code to run. There doesn't have to be a single entity with universal root. In such an environment, encryption at rest can come in handy because it mitigates some of the physical attack vectors.
- ec109685 8y agoIt definitely helps for physical attack vectors.
- finchisko 8y agoIn theory yes. In practice most of the tasks including key/password management is left on sysadmins anyway, because management don't bother and not even interested how this stuff works. They're just not technical people, their priorities are elsewhere. And that's ok.