What is the difference between encryption in transit and encryption at rest?
Options
- Transit: data on the network (TLS). Rest: stored data (Correct option)
- They are the same thing, only named differently
- In transit is for files; at rest is for emails
- At rest only applies to passwords stored in the DB
Answer
In transit protects data moving over a network (TLS); at rest protects stored data (disk, database, backups)
Why
Data has two main exposure moments:
- In transit: while traveling between client and server or between services. Use TLS/HTTPS everywhere, including internal service-to-service traffic (sometimes with mutual TLS).
- At rest: while stored. Use disk, database and backup encryption (AWS KMS, Azure Key Vault keys, TDE in databases).
Managed cloud storage usually offers at-rest encryption by default; you still must manage keys and access.
Remember
Transit = TLS. Rest = encrypted storage with managed keys.