Comparison
Encryption at restvsEncryption in transit
Encryption at rest
the data on disk is encrypted, which protects you against a stolen drive and against nothing that happens through your own API.
Encrypting stored data so the ciphertext is useless without the key. It satisfies a real threat model — physical media, backup files, decommissioned disks — and a lot of compliance text. It does nothing against an attacker who has your application's access, because your application decrypts transparently.
Full entry →Encryption in transit
you terminate TLS at the edge and then have to decide whether the internal hop after it is plaintext.
Protecting data moving over a network, in practice TLS. The interesting question is where it terminates: many systems encrypt to the load balancer and run plaintext behind it, which assumes the internal network is trusted. Zero-trust architectures reject that assumption, which is the argument for mTLS between services.
Full entry →