Encryption in transit: Protects data moving over networks
- TLS/HTTPS between client and server
- mTLS between internal services
- Prevents eavesdropping and tampering
Encryption at rest: Protects stored data
- Database encryption (transparent or column-level)
- Disk encryption (AWS EBS, Azure Disk)
- Application-level encryption for sensitive fields
Key management:
- Never store keys with encrypted data
- Use KMS (AWS KMS, HashiCorp Vault)
- Rotate keys periodically
- Separate keys per tenant in multi-tenant systems
Both are required for compliance (PCI-DSS, HIPAA, GDPR).