June 13, 2021
What Is Data at Rest?
Just like it sounds, “data at rest” refers to information stored on hard drives, flash drives, or archives. This inactive data does not move and stays where it is. While data at rest is more difficult to steal, it’s also usually more valuable to cybercriminals.
The Challenges of Protecting Data at Rest
Data might stay still, but it can sit in a variety of different locations, including workstations, mobile devices, servers, and even the cloud. Keeping track of where it’s all located and how to protect it everywhere can be costly.
You also have to ensure that the encryption keys you use are not kept in the same location as the data itself. These steps are necessary for ensuring compliance with data protection regulations such as the GDPR and HIPAA, which often deal with data at rest.
[sc name=”glossary-cta” ][/sc]Methods of Protection For Resting Data
There are many best practices for ensuring the security of resting data, and encryption is a common theme among them. They include:
- File encryption before storage. In some cases, the enterprise may choose to encrypt the entire storage drive.
- Database encryption. A technology known as transparent data encryption (TDE) works well for database purposes, as it performs its operations and creates log files in real time.
- Mobile device management, or MDM, deals with sensitive data stored on mobile devices like laptops, phones, and tablets. It’s especially useful whenever your business loses a device.
- Digital rights management is a type of encryption that allows the receiver of the data certain permissions like reading or editing without fully decryping the data for full access.
- Data leak prevention, or DLP, can block access in case it detects a security policy violation to make sure no data becomes breached or destroyed. However, DLP only applies to data contained within the organization and does little for the data that is exported.
- Cloud Access Security Brokers, or CASB, is a set of security policies available in cloud systems like Office 365 and Salesforce. Think of it as DLP but applied to cloud applications.
Protecting data at rest is largely about analyzing the primary risks and selecting the tools and technologies that give you the right amount of protection you need.
What Is Data in Transit?
Data in transit moves through the network, whether it’s a private business network or the Internet. Every time you move information, such as uploading from local storage to a cloud environment, you need to protect that content as it moves.
The Challenges of Protecting Data in Transit
Enterprises today use a broad variety of communication channels, from email to web to even cloud applications like Salesforce and G-Suite. Handling security for all those transfers can be challenging. On top of that, you need a way to protect that data once it reaches the recipient.
Methods of Protection For Moving Data
Data in motion is less secure because it’s harder to track, but there are still solutions for working with moving information.
- Using encrypted connections like HTTPS, SSL, and TLS are common tools to use before sending out content.
- Email encryption is an end-to-end method for protecting message bodies and attachments from interception.
- Managed file transfer (MFT) works by uploading data to a platform and allowing the recipient to download it using an HTTPS link. The link itself could come with an expiration date or require password access.
- DLP and CASB, tools mentioned in the data at rest section, are also applicable to data in transit. Digital rights management technology can also apply here, restricting, for example, the ability to forward the contents of an email if desired.
There’s actually a third state data could be in when the enterprise is working with it: data in use.
The Third State: Data in Use
Data is considered “in use” when it’s currently opened by an application or a user is accessing it. Many of the solutions we’ve talked about only work before the end user receives the data and have little impact once the usage begins. Protecting data in use largely depends on methods like:
- Identity management to make sure the end user is the correct, authorized entity to receive the data.
- Role-Based Access Control for checking the end user’s locations, IP, and roles in the organization.
Once the data reaches the right entity, digital rights protection is often used to limit what the recipient can do with the data. It combines encryption with permissions management for this purpose.
How are data in process different from data at rest or data in transit?
The key difference is activity. Data in process (or data in use) is data that’s actively being accessed, read, or modified by applications or users. In contrast, data at rest is stored and inactive, whereas data in transit (or in motion) is moving between systems or networks. Because it’s directly exposed during processing, data in use is often the most vulnerable state, requiring additional safeguards like encryption, authentication, and strict access controls.
Best Practices for Data Protection In Transit and At Rest
Unprotected data, whether at rest, in use, or in transit, creates an easy entry point for attackers. Here are some best practices to protect your data:
1. Encrypt data at rest and in transit: Full-disk encryption protects stored data on laptops, servers, or mobile devices, while TLS/SSL protocols, VPNs, and email encryption keep data secure as it travels across networks. Sensitive files should never move in plaintext. Learn more about data encryption.
2. Deploy robust network and endpoint security: Firewalls, anti-malware, intrusion detection, and network access controls protect the channels through which data travels. Mobile device management (MDM) solutions extend these controls to smartphones and tablets, blocking compromised devices and enforcing encryption.
3. Use Data Loss Prevention (DLP) and Cloud Access Security Brokers (CASBs): DLP tools monitor sensitive data across endpoints, emails, and file transfers, preventing leaks before they happen. CASBs extend these protections into the cloud, applying consistent security and compliance policies to SaaS and collaboration platforms, such as Microsoft 365, Teams, or Slack.
4. Classify and control sensitive data: Systematically identify and categorize data so the proper protection policies can be applied. For example, enforce automatic encryption or blocking for files containing regulated or confidential information when they are stored, accessed, or shared.
5. Be proactive, not reactive: Don’t wait for a breach. Continuously monitor for risks, enforce policies before data leaves your control, and regularly review vendor security practices if you rely on public, private, or hybrid cloud providers. Always ask: Who has access to your data? How is it encrypted? How often is it backed up?
By combining data encryption at rest and in transit with proactive controls, classification, and strong endpoint protection, enterprises can reduce the risk of breaches and ensure sensitive information remains secure in every state.
FAQs on Data at Rest vs Data in Transit
What’s the Difference Between Data in Transit vs. Data at Rest?
The difference lies in where the data resides and how it’s handled. Data in transit (or in motion) is actively being transferred between systems or networks, making it more vulnerable and susceptible to interception. Data at rest, on the other hand, is stored and inactive. While stored data can be physically secured and may seem more stable, it remains a high-value target for attackers.
Both states require strong protection, typically data security at rest and in transit through encryption and access controls. However, the risks and strategies differ depending on whether the data is moving or stationary.
What are the examples of Data in Rest?
- Files and documents stored on hard drives, SSDs, or laptops
- Databases and data warehouses
- Archives, backups, and storage tapes (including off-site or cloud backups)
- Spreadsheets and shared files on file-hosting services
- Cloud storage services and virtual machines
- Mobile devices or removable media such as USB drives
What are the examples of Data in Transit?
- Data transferred between a user’s mobile device and a cloud-based application
- Emails, file transfers, and instant messages sent across the internet
- Collaboration data shared through platforms like Microsoft Teams or Slack
- Live streams, video calls, or e-commerce transactions
- Information moving between servers or from on-premises systems to the cloud
