Encryption at Rest

Encrypting stored data protects it when the storage medium is lost, stolen, or accessed outside the running system's controls.

Protecting Data That Sits Still

Data at rest is data in storage: on disks, in databases, in backups, on removable media. Encryption at rest ensures that if the physical medium falls into the wrong hands, the bytes are unintelligible without the key. It protects against theft of a drive, disposal of hardware without wiping, or an attacker who copies files but cannot decrypt them.

Where It Applies

Kronos motion — when

Full-disk encryption for whole volumes
Filesystem or file-level encryption for selected data
Database encryption, transparent or column-level
Encrypted backups and archives
Self-encrypting drives with hardware key handling

Symmetric Ciphers

At-rest encryption almost always uses a symmetric cipher such as AES, because the same party writes and reads the data and symmetric algorithms are fast on large volumes. AES with a 256-bit key in an authenticated mode like GCM provides both confidentiality and integrity, so tampering is detected, not just concealed.

The Key Is the Weak Point

Encryption at rest is only as strong as its key management. If the key sits on the same disk in plaintext, the encryption is theater. Keys should live in a separate, protected store, a hardware security module or a dedicated key service, and access to them should be logged and controlled independently of access to the data.

Fusion Context

A fusion program generates sensitive design, simulation, and operational data that must be protected in storage and in backups. Encryption at rest, with keys held apart from the data in managed key stores, is a baseline control for that material. It complements, rather than replaces, encryption in transit and access controls, since each protects against a different failure.