> You could exfiltrate the data (download or upload to a remote server). What can you do with this data if it was encrypted at rest? Not much. How do I encrypt

> You could exfiltrate the data (download or upload to a remote server). What can you do with this data if it was encrypted at rest? Not much. How do I encrypt a database at rest? How does it work? Say, I run a hospital and I want to write patient data to a database. Do I have to decrypt the whole database before I add new data? Each time? Do I also have to decrypt the database each time I query data? How does that work when two doctors want to access the database at the same time? I assume that constant decryption and encryption of large amount of data adds a significant overhead. So in practice, while data is encrypted at rest, most of the time the data isn't resting, but actively loaded and used and unencrypted. And now, when a bad actor gets access to that live running database, they can exfiltrate the data.