Data at rest, in transit and in use: protecting information in all three states

Security people describe data by its state: at rest (stored on a disk, a phone or a server), in transit (moving across a network) and in use (loaded in memory while a program works on it). Each state has its own risks and its own protections, and a system is only as strong as the state it protects worst. Encrypting a laptop’s disk does nothing for the same file once you email it; encrypting the email does nothing once the recipient opens it.

At rest: full-disk encryption and backups

The main threat to stored data is physical: a lost laptop, a stolen phone, a discarded drive. Full-disk encryption answers it. On a Mac, FileVault encrypts the startup volume with AES, and Apple’s Platform Security Guide explains that on Macs with Apple silicon the encryption keys are protected by the Secure Enclave, so the disk cannot simply be read in another machine. NIST’s guide to storage encryption, SP 800-111, makes the same point in general terms: encryption at rest is only as good as the protection of its key, which is why the key is tied to your login password and hardware.

• Turn on FileVault (System Settings › Privacy & Security) and keep the recovery key somewhere safe and offline.
• Encrypt backups too. An unencrypted backup drive undoes the protection of an encrypted laptop.
• Remember what at-rest encryption does not do: once you are logged in, the files are readable to you, and to any app or intruder running as you.

In transit: TLS everywhere, and knowing who you send to

Data crossing a network can be read or altered by anyone on the path: the café Wi-Fi, a compromised router, an internet provider. TLS protects web traffic, email between servers and most app connections, as the previous lesson explained. End-to-end encryption goes further, keeping content unreadable even to the service carrying it. Two gaps remain. First, metadata, who talks to whom, when and how much, is often visible even when content is encrypted. Second, encryption in transit says nothing about where the data is going. A perfectly encrypted connection can still carry your contacts to an analytics company you never agreed to.

In use: the hardest state to protect

To work on data, a program must decrypt it into memory. That makes data in use the favorite target of malicious software: an infostealer reads passwords and cookies from memory and files while you are logged in, and full-disk encryption cannot stop it because the disk is already unlocked. Protections here are about limiting who runs code on the machine and what that code can reach: keeping the operating system updated, installing only signed software, granting app permissions sparingly, and watching what leaves the machine.

For servers and cloud workloads, a newer family of techniques called confidential computing uses hardware-based trusted execution environments to keep data encrypted in memory even from the cloud provider’s own administrators. The Confidential Computing Consortium, a Linux Foundation project, coordinates this work. It is powerful but specialized, and it does not replace the basics.

Putting the three together