The title is a bit click baity. I agree with the basic premise that people and companies often think that encryption at rest provides more protection than it r

The title is a bit click baity. I agree with the basic premise that people and companies often think that encryption at rest provides more protection than it really does. We should however distinguish between encryption at rest for storage devices and other forms of encryption at rest. You can also encrypt data at rest at the application or database layers too, and they provide protection against more than just physical access to the storage device. Like all encryption, it's all about who can get the keys.