Funny I always considered the impetus of Encryption at Rest to be the "left my laptop in the airport scenario". Or, maybe, "Where'd that CD with all of the medi

Funny I always considered the impetus of Encryption at Rest to be the "left my laptop in the airport scenario". Or, maybe, "Where'd that CD with all of the medical records go?" Originally, I never felt that the EAR issue was that germane at data centers, since you're mostly protecting against someone backing through the loading door with a truck and stealing trays of drives. The disposal issue is valid, that was just something we were diligent with using a secure disposal service. Key management has always been an issue. Since no one wanted to be there when the machines spooled up after a glitch at 3am to type in a password to open the volumes. Everything else is basically locking the file cabinet drawers and taping the key to the back of it. Nowadays, it's different. Its more ubiquitous. Encrypting a laptop is a mouse click, and painless after that. Cloud providers have the infrastructure to manage it at their level. I'm still now sure what the solution is for a "self hosted" infrastructure. Hardware key modules are still pretty expensive. I haven't (not that I've looked at all recently) seen a writeup of how best to set of encryption on those 4 Dells my friend has racked across the country in Georgia (though even modern machines have some level of volume encryption I think).