The management team has mandated the use of data-at-rest encryption on all corporate servers. Using this encryption paradigm will ensure:

Data-at-rest encryption is a security control that protects data stored on a physical medium, such as a server's hard drives or solid-state drives. The primary function of this type of encryption is to make the data unreadable and unusable to an unauthorized party who gains physical access to the storage device. Therefore, if a server or its drives are physically stolen, the encrypted files cannot be accessed without the corresponding decryption key, directly mitigating the risk of data breaches from physical theft.

A. Protecting website traffic traversing the internet is accomplished by data-in-transit encryption, such as Transport Layer Security (TLS), not data-at-rest encryption.
C. Securing email attachments from interception during transmission is a function of data-in-transit encryption (e.g., SMTP with TLS) or end-to-end encryption (e.g., S/MIME).
D. While data-at-rest encryption protects database files on disk, it does not protect data from a remote hacker who compromises the running database application, which decrypts data for use. ---

1. National Institute of Standards and Technology (NIST). (2007). NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices. Section 2.1, "Threats," explicitly lists "Theft or loss of the device" as a primary threat that storage encryption is designed to mitigate.

2. Microsoft Corporation. (2023). BitLocker overview. Microsoft Learn. In the "Data protection" section, the document states, "BitLocker helps mitigate unauthorized data access by enhancing file and system protections. BitLocker also helps render data inaccessible when BitLocker-protected computers are decommissioned or recycled," directly addressing threats related to physical possession of the hardware.

3. Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 6.3, "Full Disk Encryption," the text explains that full disk encryption's purpose is to ensure "that all the data on a disk is encrypted... This is a powerful security measure against data theft when a computer is lost or stolen."