3 ms·
Definitely true and a layered defense against data loss / theft has obvious advantages. But take for instance a small SaaS running on a cloud PaaS (e.g., AWS, G
by thelittleone 2y ago
Definitely true and a layered defense against data loss / theft has obvious advantages. But take for instance a small SaaS running on a cloud PaaS (e.g., AWS, GCP etc). What it the likelihood of improper disposal of a hard disk? And then what is the likelihood this improperly disposed of hard disk survives the process of removal / improper disposal to then be found by someone nefarious? And then, what is the likelihood that that particular drive was in a volume that contained anything sensitive.
Then what is the cost / overhead / complexity / other cons of adding encryption at rest? Cyber budgets often go crazy I see so many clients that are buying tech based on marketing hype or the security teams lusts for cool tech rather than what reduces the risk the most for the dollars available.
- JackSlateur 2y agoLast time I implemented encryption at rest (when I worked for a small cloud provider), it was as easy as adding an option when creating the disk. The option triggered the implementation of a dm-crypt layer between the physical device and the upper storage layers. Crypto keys were stored in the storage system. Once revoked, the whole server was rendered useless (from a data thief point of view). We benchmarked the stuff a bit. Indeed, there was a loss. While dm-crypt uses AES (with hardware acceleration) and since we had multi-hundreds of thousands IOPS per device, we did not care.
- thelittleone 2y agoMost of my clients won't care about that slight performance hit either. Thanks for the info.