skills.rest
hung-phan
hung-phanCOMMUNITY
Explore all skills by this author →
GitHub

encryption-at-rest

Encrypt stored data across databases, object stores, and backups.

Updated Jun 5, 2026
Search Tags:#data protection#cryptography#data security#encryption at rest#encryption algorithms
One-click install
npx skills add https://github.com/hung-phan/system-skills --skill encryption-at-rest
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: encryption-at-rest
Source: https://github.com/hung-phan/system-skills/tree/main/skills/system-review/references/security/encryption-at-rest
Command: npx skills add https://github.com/hung-phan/system-skills --skill encryption-at-rest

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Encryption at rest is used to protect stored data from offline attackers, stolen disks, leaked backups, and rogue insiders.

Core Features & Use Cases

  • Data Encryption: Encrypts databases, object stores, message queues, or backups to protect data at rest.
  • Multi-Layered Defense: Offers a stack of layers, each defending against different threats, like full-disk, filesystem, database TDE, application envelope, tokenization, and client-side encryption.
  • Use Case: Suitable for storing PII, PHI, payment data, secrets, credentials, and meets compliance requirements like GDPR / HIPAA / PCI-DSS / SOC 2.

Quick Start

Run the 'encrypt-at-rest' script with the following command to encrypt a file using KMS:

encrypt-at-rest --input path/to/file --key-id <KMS_KEY_ID>

Frequently Asked Questions about encryption-at-rest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I encrypt sensitive data at rest to meet GDPR and HIPAA compliance requirements?▼

To encrypt sensitive data at rest and meet GDPR or HIPAA requirements, you can apply multiple layers of encryption like full-disk, database TDE, and application envelope encryption to protect stored PII and PHI.

What is the best way to protect databases and object stores from offline attackers?▼

The best way to protect databases and object stores from offline attackers is implementing a multi-layered defense strategy, combining filesystem encryption, database TDE, and application envelope encryption.

How do I encrypt a file using a KMS key?▼

You can encrypt a file using a KMS key by running the 'encrypt-at-rest' script with the input file path and the specific KMS key ID to secure the stored data.

When do I need application envelope encryption versus full-disk encryption?▼

You need application envelope encryption when protecting data from rogue insiders with direct database access, whereas full-disk encryption primarily defends against stolen disks and leaked backups.

Can I use tokenization and client-side encryption for payment data storage?▼

Yes, you can use tokenization and client-side encryption to secure payment data storage, ensuring sensitive information remains protected and compliant with PCI-DSS regulations.

Does multi-layered encryption work for message queues and backups?▼

Yes, multi-layered encryption works for message queues and backups by applying various cryptographic layers to protect stored data against unauthorized access and offline threats.

Related Skills

Explore More Software Engineering Skills→
2nth-ai2nth-ai
1

tech/cloudflare

Deploy JavaScript/TypeScript code on Cloudflare's edge network.

Official
Advanced
proffesor-for-testingproffesor-for-testing
436

compliance-testing

Map GDPR, HIPAA, PCI-DSS, SOC 2, and CCPA regulations to testable controls.

Community
Advanced
davidrrowleydavidrrowley

azure-keyvault-keys-rust

Manage Azure Key Vault cryptographic keys from Rust applications.

Community
Intermediate
expanso-ioexpanso-io

expanso-encrypt-data

Encrypt sensitive data fields using AES-256-GCM encryption.

Official
Advanced