<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-encryption-at-rest
description: >-
  Assess and implement encryption at rest for filesystems, databases, cloud
  storage, and backups. Covers LUKS/dm-crypt, BitLocker, FileVault, cloud-native
  encryption (AWS S3 SSE, Azure Storage Encryption, GCP CMEK), Transparent Data
  Encryption (TDE), and compliance verification.
domain: cybersecurity
subdomain: cryptography
tags:
  - encryption-at-rest
  - luks
  - dm-crypt
  - bitlocker
  - tde
  - aws-s3-sse
  - disk-encryption
  - database-encryption
  - cloud-encryption
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Analyzing Encryption at Rest

## Overview

Encryption at rest protects data on disk from physical theft, unauthorized
access, and insider threats. This skill covers auditing and implementing
encryption for storage volumes, databases, object stores, and backups across
on-premises and cloud environments.

## Prerequisites

| Requirement | Install |
|---|---|
| cryptsetup | `apt install cryptsetup` |
| AWS CLI | `pip install awscli` |
| OpenSSL 3.x | `apt install openssl` |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Linux Full Disk Encryption (LUKS)

```bash
# Check if a volume is LUKS encrypted
cryptsetup isLuks /dev/sda2 && echo "LUKS encrypted" || echo "Not encrypted"

# Show LUKS header information
cryptsetup luksDump /dev/sda2

# Create LUKS encrypted volume
cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 \
  --key-size 512 --hash sha256 /dev/sdb1

# Open encrypted volume
cryptsetup luksOpen /dev/sdb1 encrypted_vol

# Check dm-crypt status
dmsetup status encrypted_vol
cryptsetup status encrypted_vol

# Add a backup key slot
cryptsetup luksAddKey /dev/sdb1

# Audit LUKS cipher and key size
cryptsetup luksDump /dev/sda2 | grep -E "Cipher|Key|Hash"
```

### Cloud Storage Encryption Audit

```bash
# AWS S3 — check bucket encryption
aws s3api get-bucket-encryption --bucket my-bucket

# AWS S3 — check object encryption
aws s3api head-object --bucket my-bucket --key file.txt | \
  jq '.ServerSideEncryption, .SSEKMSKeyId'

# AWS EBS — check volume encryption
aws ec2 describe-volumes --volume-ids vol-12345 | \
  jq '.Volumes[].Encrypted'

# AWS RDS — check storage encryption
aws rds describe-db-instances --db-instance-identifier mydb | \
  jq '.DBInstances[].StorageEncrypted'

# Azure Storage — check encryption
az storage account show --name myaccount --query "encryption"

# GCP — check disk encryption
gcloud compute disks describe my-disk --zone us-central1-a \
  --format="value(diskEncryptionKey)"
```

### Database Transparent Data Encryption

```bash
# PostgreSQL — check data directory encryption
# pgcrypto extension for column-level encryption
psql -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;"
psql -c "SELECT pgp_sym_encrypt('secret', 'key');"

# MySQL — check TDE status
mysql -e "SELECT * FROM information_schema.INNODB_TABLESPACES_ENCRYPTION;"

# SQL Server — check TDE
# SELECT db.name, db.is_encrypted, dek.encryption_state
# FROM sys.databases db
# LEFT JOIN sys.dm_database_encryption_keys dek ON db.database_id = dek.database_id;
```

### Compliance Requirements

| Standard | Requirement | Algorithm |
|---|---|---|
| PCI DSS 4.0 (Req 3.5) | Encrypt stored cardholder data | AES-256 |
| HIPAA (§164.312) | Encrypt ePHI at rest | AES-128+ |
| GDPR (Art. 32) | Encryption as technical measure | AES-256 recommended |
| SOC 2 (CC6.1) | Logical and physical access controls | AES-256 |
| NIST 800-171 (3.13.16) | Protect CUI at rest | FIPS 140-2 validated |

## Workflow

1. **Inventory** — List all data stores (disks, databases, object stores, backups)
2. **Classify** — Identify regulated/sensitive data requiring encryption
3. **Audit** — Check current encryption status for each data store
4. **Remediate** — Enable encryption where missing, upgrade weak algorithms
5. **Key Management** — Ensure encryption keys are in KMS/HSM
6. **Verify** — Automated checks in CI/CD and compliance dashboards

## Verification

| Check | Method |
|---|---|
| LUKS active | `cryptsetup isLuks` returns 0 |
| AES-256 cipher | `cryptsetup luksDump` shows `aes-xts-plain64` with 512-bit key |
| S3 encrypted | `get-bucket-encryption` returns SSE-KMS or SSE-S3 |
| EBS encrypted | `describe-volumes` shows `Encrypted: true` |
| RDS encrypted | `describe-db-instances` shows `StorageEncrypted: true` |
| Key in KMS | Encryption uses KMS-managed key, not default |

## References

- [LUKS2 Specification](https://gitlab.com/cryptsetup/LUKS2-docs)
- [AWS Encryption at Rest](https://docs.aws.amazon.com/whitepapers/latest/efs-encrypted-file-systems/encryption-of-data-at-rest.html)
- [NIST SP 800-111 — Storage Encryption](https://csrc.nist.gov/publications/detail/sp/800-111/final)
- [PCI DSS v4.0 Requirement 3](https://www.pcisecuritystandards.org/)
