Data security: at rest vs. in transit

In today’s digital landscape, securing data is not just a necessity but a fundamental requirement for any business handling sensitive information. Whether it’s customer data, financial records, intellectual property, or operational logs, enforcing robust security measures is crucial. AWS provides a comprehensive suite of tools and services to protect data both at rest and in transit. In this post we explore what these terms mean, why they matter, and how your organisation can implement best practices for airtight data protection.

Understanding data security

What is data at rest?

Data at rest refers to information that is stored on physical or cloud-based storage devices, such as:

• Databases (RDS, DynamoDB)
• Object storage (S3)
• Block storage (EBS)
• Backups and snapshots

This data remains inactive until it is accessed, processed, or modified.

What is data in transit?

Data in transit refers to information actively moving between systems or locations, such as:

• Between users and applications
• From on-premises to the cloud
• Between AWS services across a VPC or over the internet

During transit, data is vulnerable to interception, eavesdropping, and unauthorised access if not properly encrypted.

Why data security matters

Regulatory compliance. Industries like finance, healthcare, and e-commerce must adhere to standards such as GDPR, HIPAA, PCI-DSS, and SOC 2.

Preventing breaches. With cyberattacks on the rise, a single breach can inflict financial loss, reputational damage, and legal penalties.

Customer trust. Demonstrating robust security builds credibility and fosters long-term loyalty.

Business continuity. Proper data protection ensures operations are not disrupted by security incidents or data loss.

Implementing security for data at rest on AWS

1. AWS Key Management Service (KMS)

• Centralised key management for all your encryption needs
• Supports envelope encryption to efficiently handle large volumes of data
• Natively integrated with S3, RDS, DynamoDB, EBS, and more

2. Amazon S3 encryption

Server-side encryption (SSE):

• SSE-S3 (managed by AWS)
• SSE-KMS (your keys in KMS)
• SSE-C (customer-provided keys)

Client-side encryption: encrypt data locally before upload.

3. EBS volume encryption

• Encrypt EBS block storage volumes using KMS
• Automatic encryption of snapshots and restored volumes

4. RDS and DynamoDB encryption

• Transparent, storage-level encryption for relational databases (MySQL, PostgreSQL, SQL Server, Oracle) and DynamoDB
• Keys managed and rotated through KMS

5. Backup and snapshot encryption

• AWS Backup supports encryption for backup vaults
• Encrypted EBS snapshots inherit the volume’s encryption settings

Implementing security for data in transit on AWS

1. TLS encryption

• Enforce TLS 1.2+ for all application traffic (API Gateway, ELB/ALB, CloudFront)
• Use AWS Certificate Manager to provision and manage TLS certificates

2. VPN and Direct Connect

• Site-to-site VPN: encrypted tunnels from on-premises to AWS
• AWS Direct Connect: dedicated private fibre link for reduced exposure

3. Secure API access

• IAM policies and security groups to control access
• AWS Signature Version 4 (SigV4) for request signing and integrity

4. Private networking options

• AWS PrivateLink: privately expose services across VPCs without internet
• VPC Peering: direct, private communication between VPCs

Who needs these security measures?

While all organisations benefit from data encryption, certain industries face heightened requirements:

• Financial services (banks, fintechs, payment processors)
• Healthcare (hospitals, research institutions)
• E-commerce and retail (credit card processing, PII storage)
• Government and defence (classified and mission-critical data)
• Technology and SaaS (multi-tenant cloud services)
• Media and entertainment (copyrighted content delivery)
• Education (student records, research archives)

Best practices for secure AWS data management

1. Enable MFA on all AWS accounts and privileged roles.
2. Implement role-based access control (RBAC) with least-privilege IAM policies.
3. Rotate encryption keys regularly in AWS KMS.
4. Monitor and audit via AWS CloudTrail, AWS Config, and AWS Security Hub.
5. Run continuous assessments with Amazon Inspector and Amazon GuardDuty.
6. Use AWS Secrets Manager to store and rotate database credentials.
7. Enable Amazon Macie to discover and classify sensitive data in S3.

Conclusion and next steps

Data security is not optional - it is a business imperative. AWS’s rich security ecosystem lets you safeguard data both at rest and in transit, achieve regulatory compliance, and build customer trust.

If your organisation needs expert guidance on crafting or auditing your AWS security posture, get in touch to learn how we can fortify your data defences.