<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-database-encryption
description: >-
  Implement encryption-at-rest and encryption-in-transit for relational and NoSQL
  databases using TDE, column-level encryption, and client-side field encryption
  to protect sensitive data stores against unauthorized access and breach exposure.
domain: cybersecurity
subdomain: data-security
tags:
  - database-encryption
  - tde
  - column-encryption
  - encryption-at-rest
  - encryption-in-transit
  - key-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1565"]
---

# Implementing Database Encryption

## Overview

Database encryption protects sensitive data stored in relational and NoSQL databases
by rendering it unreadable without proper decryption keys. This skill covers
Transparent Data Encryption (TDE), column-level encryption, client-side field
encryption, and key management. Effective database encryption reduces breach
impact, satisfies PCI DSS Requirement 3, and supports GDPR Article 32.

Mode: `[MODE: ARCHITECT]` — Database encryption design and deployment.

## Prerequisites

- Database administrator access (MySQL, PostgreSQL, SQL Server, or MongoDB)
- Key Management System — AWS KMS, Azure Key Vault, or HashiCorp Vault
- TLS certificates for in-transit encryption
- Backup infrastructure supporting encrypted backups
- Change management process for encryption rollouts

## Key Concepts

### Database Encryption Layers

| Layer | Method | Protection Scope |
|-------|--------|------------------|
| Storage | TDE (Transparent Data Encryption) | Full database files at rest |
| Column | Column-level / cell-level encryption | Individual sensitive columns |
| Field | Client-side field encryption (CSFLE) | Application-layer before storage |
| Transit | TLS 1.2+ / mTLS | Data moving between app and DB |
| Backup | Encrypted backup streams | Database dumps and snapshots |

### Encryption Architecture

```
Encryption stack:
├── Transparent Data Encryption (TDE)
│   ├── Encrypts data files, log files, and backups
│   ├── Transparent to applications — no code changes
│   └── SQL Server, Oracle, PostgreSQL, MySQL InnoDB
├── Column-Level Encryption
│   ├── Encrypt specific columns (SSN, credit card, PHI)
│   ├── Different keys per column for least privilege
│   └── Requires application changes for encrypt/decrypt
├── Client-Side Field Encryption
│   ├── MongoDB CSFLE / AWS DynamoDB client-side
│   └── Data encrypted before reaching the database
├── In-Transit Encryption
│   ├── TLS 1.2+ for all database connections
│   └── mTLS for service-to-database authentication
└── Key Management
    ├── HSM-backed master keys
    ├── Key rotation schedules (90-day minimum)
    └── Separation of duties — DBA ≠ key custodian
```

### CLI Commands

```bash
# Enable TDE on PostgreSQL with pgcrypto
psql -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;"
psql -c "ALTER SYSTEM SET ssl = on;"

# SQL Server TDE setup
sqlcmd -Q "CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_256 \
  ENCRYPTION BY SERVER CERTIFICATE TDECert;"

# Audit encryption status
node scripts/agent.js --action audit --input /tmp/db_inventory.json \
  --output /tmp/encryption_audit.json

# Generate encryption configuration
node scripts/agent.js --action configure --db-type postgresql \
  --encryption-level column --output /tmp/encryption_config.json

# Check key rotation compliance
node scripts/agent.js --action key-audit --input /tmp/key_inventory.json \
  --output /tmp/key_rotation_report.json
```

## Workflow

### Step 1: Inventory Database Assets

Catalog all databases, sensitive columns, and current encryption state.

### Step 2: Deploy TDE for At-Rest Protection

```bash
node scripts/agent.js --action audit --input /tmp/db_inventory.json \
  --output /tmp/encryption_audit.json
```

### Step 3: Implement Column-Level Encryption

Encrypt sensitive columns identified during data classification.

### Step 4: Enable TLS for In-Transit Protection

Configure TLS 1.2+ on all database listeners and enforce encrypted connections.

### Step 5: Establish Key Rotation

Set up automated key rotation with HSM-backed master keys.

## Detection

```yaml
title: Database Encryption Detection
id: dfb5c471-5204-46bd-a74f-f8822dcf92a4
status: experimental
description: Detects suspicious activity related to implementing database encryption techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1565
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] TDE enabled on all production databases containing sensitive data
- [ ] Column-level encryption applied to PII/PHI/PCI columns
- [ ] TLS 1.2+ enforced for all database connections
- [ ] Key rotation automated on 90-day schedule or less
- [ ] Encryption keys stored in HSM or managed KMS
- [ ] Backup encryption verified with restore testing
- [ ] Separation of duties enforced between DBA and key custodian

## References

- [NIST SP 800-111 — Storage Encryption Technologies](https://csrc.nist.gov/publications/detail/sp/800-111/final)
- [PCI DSS Requirement 3 — Protect Stored Account Data](https://www.pcisecuritystandards.org/)
- [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)
- [MITRE ATT&CK T1565.001 — Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/)
