Data at Rest Encryption Going Beyond the Basics to Address Modern Attacks

on YouTube ↗47m

" summary

Transparent disk or database encryption stops physical theft but fails against SQL injection, ransomware exfiltration, and privileged insiders; attackers pull decrypted rows or reuse harvested DB creds. Examples: ~500 million Marriott records exposed, a 7‑Eleven SQLi leaking ~130 million cards, and a 2019 app flaw enabling ~$600k theft. Prefer Application-Level Encryption (ALE) or field-level encryption with strong key lifecycle (HSM/TPM, rotation, least privilege) and client-side crypto (AES/TLS where appropriate) instead of checkbox TDE or S3/bucket-only encryption.

AI-written summary · about

" chapters (15)

1. 0:00Intro
2. 1:47What will they talk about? • Quick primer on cryptography, encryption, and key management • Issues with current at-rest data encryption approaches
3. 2:38A02:2021 - Cryptographic Failures
4. 4:44Cryptography Cryptography was practiced for millennia before the Invention of computers One of the original and fundamental mechanisms for computer security
5. 6:15Cryptographic Attacks . Modern cryptography is exceptionally strong against direct attacks
6. 9:25Problem - Keys
7. 10:47Two Predominant Use Cases for Encryption
8. 14:15The Central Implicit Trust Model
9. 15:44So, what's the problem with that?
10. 19:20Two Real-world Examples Security Incident
11. 25:43Better Approach
12. 31:56Example - Medical Records System Only a subset of data values and attachments are to be protected
13. 35:59Column-Level Encryption
14. 42:09Application-Level Encryption (ALE)
15. 45:38Parting Words of Crypto Advice

" related talks

• 41mKeeping Secrets: Emerging Practice in Database EncryptionKenn White · Black Hat Europe 2018
• 48mGetting To Know SQL Server Encryption CapabilitiesMladen Prajdic · SQLBits 2020
• 51mWhere should I be encrypting my dataDenny Cherry · SQLBits 2022
• 34mWhy your encrypted Database isn't secure: practical attacks against encrypted OSS databasesDan Draper · linux.conf.au 2022
• 51mWhere should I be encrypting my dataDenny Cherry · SQLBits 2019
• 48mProtecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2Jakub Szymaszek · SQLBits 2023
• 50mSecuring IoT Data with Pervasive EncryptionEysha Shirrine Powers · Data Con LA 2019
• 59mDatabase Encryption in a GDPR WorldScott Dutton · PHP UK Conference 2019