Encrypt data at rest and in transit

I walk through storage encryption and TLS so you can protect data at rest and in transit. I include simple checks to confirm it is working across your systems.

Encrypt data at rest and in transit by turning on storage encryption and enforcing TLS on every connection. This plan is practical for small teams and fits most setups.

Encrypt data at rest

Make an asset list of devices, servers, databases, file shares, backups, and logs.
Enable full disk encryption on laptops, desktops, and servers. Use a strong passphrase and store recovery keys in a secure vault.
Turn on database encryption in your managed database, or use volume encryption for self hosted databases. Encrypt the most sensitive fields in the application.
Encrypt backups and snapshots by default. Confirm no tool writes unencrypted temp files.
Encrypt phones and tablets that sync business data. Require a PIN and auto lock.
Control and rotate keys. Keep keys separate from the data and limit who can read them.

Encrypt data in transit

Serve every site and app over HTTPS with a valid TLS certificate. Redirect HTTP to HTTPS.
Use only current TLS versions and strong ciphers. Disable old protocols.
Set HSTS to require secure connections after the first visit.
Use SFTP or SSH for admin access and file transfers. Do not allow plain FTP or Telnet.
Require HTTPS for all APIs and webhooks. Use TLS for email transport where supported.
For admin portals and internal APIs, add mutual TLS or a VPN for stronger channel protection.

What to check when done

Visit common paths like login and forms and confirm they load only over HTTPS.
Run a TLS configuration check and fix any warnings about versions or ciphers.
Restore a test backup and confirm it was encrypted at rest and during transfer.
Review key access and rotation. Only necessary people and services can reach production keys.
Simulate a lost device. Revoke access and confirm device storage was encrypted.
If you handle protected health information, review your plan with your attorney or compliance advisor.

If you want help putting this in place and documenting it, I can support you through Security & Compliance > HIPAA Compliance, Security & Compliance > WAF & Firewall, and Security & Compliance > Features & Add-ons.

Get the next one in your inbox

Pick your topics and how often, from weekly to quarterly. I send a confirmation email first, and you can change or stop it any time.

Get more like this by email

Encrypt data at rest and in transit