Encryption at Rest
Problem
Your database disk is stolen.
TLS protected data while it travelled across the network—but the data sitting on disk is still there.
Solution — Encryption at Rest
Encrypt stored data using protected keys.
Application data
↓
encryption
↓
disk
Core idea: encryption in transit protects moving data; encryption at rest protects stored data.