The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Use database encryption at rest when your concern is stolen disks or backups and you trust the database service with plaintext during authorized reads. Encrypt selected fields in the application or client before they reach the database when database administrators or the database service itself must not see those values. TLS protects the network connection, not either endpoint. These controls address different threats, so sensitive systems often use them together.
What should encryption protect against?
Start by identifying what an attacker might access: a lost storage device or backup, network traffic, a database account, a database superuser, server memory, or the application runtime and its credentials. The right encryption layer depends on which of those are outside your trust boundary.
| Control | Where it acts | What it helps protect | What it does not conceal |
|---|---|---|---|
| Encryption at rest | On stored database files, tables, or backups, according to the product | Persisted data if storage media or protected files are accessed outside the database service | Plaintext returned to an authorized database client; the service generally decrypts data for authorized use |
| TLS transport encryption | On the connection between communicating endpoints | Data captured while crossing the network | Plaintext at either endpoint, including the database service and client |
| Client-side field encryption | In the application or driver, before selected values are sent to the database | Selected values from database-side access, including access by privileged database operators, depending on the implementation | Anything left unencrypted, visible metadata, or plaintext in the client that encrypts or decrypts the value |
| Access controls | At identity, application, database, and key-management boundaries | Unauthorized actions by accounts or services that lack permission | Data accessible to a compromised or overprivileged identity |
MongoDB’s security guidance treats role-based controls, encryption at rest, transport encryption, and in-use encryption as distinct mechanisms to combine according to the threat. Encryption does not replace least-privilege access controls, and TLS does not make a trusted endpoint unable to read a value.
When is encryption at rest enough?
Database-managed encryption at rest can address a storage threat when the database service is allowed to handle plaintext during authorized reads. For example, AWS describes DynamoDB server-side encryption as transparently encrypting stored tables and decrypting data when an application accesses it. This is useful protection for persisted data, but it does not keep the service from processing plaintext during normal access.
Choose this layer when your threat model focuses on storage media or stored files and your trust model includes the database service. Keep TLS enabled for network traffic and restrict database and administrative permissions; neither storage encryption nor transport encryption limits what a permitted database identity can retrieve.
When should selected fields be encrypted in the application?
Use client-side field encryption when the database service or its privileged operators are not supposed to see particular values in plaintext. The application or database driver encrypts those values before sending them and decrypts them after retrieval. MongoDB describes Client-Side Field Level Encryption (CSFLE) in those terms and says that, with CSFLE enabled, MongoDB products do not have the data in unencrypted form.
This moves the trust boundary rather than eliminating it. The client that can decrypt a field is sensitive: protect its runtime, key permissions, plaintext in memory, logs, and any downstream service that receives decrypted values. MongoDB’s threat comparison describes CSFLE as protecting sensitive fields from direct database-superuser access, server-memory reads, on-disk database or backup reads, and network capture of encrypted fields. Metadata may still be visible, so do not assume that encrypting a value hides the record or all information about it.
AWS DynamoDB example
AWS’s Database Encryption SDK lets an application select DynamoDB attributes for client-side encryption before sending an item. AWS says the encrypted attributes are not exposed in plaintext to third parties, including AWS, and the database sees binary values. The SDK does not encrypt the entire item, attribute names, or primary-key attribute names or values. It can also sign items to help detect unauthorized changes. Treat field selection and exposed keys or metadata as part of the design, not as incidental implementation details.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
MongoDB CSFLE modes
MongoDB documents both automatic CSFLE, which avoids explicit encryption calls for each operation, and explicit CSFLE, where application code specifies the encryption logic. Its version 7.0 CSFLE guide states that Atlas and Enterprise Advanced support automatic and explicit encryption, while Community Edition supports explicit encryption only. That is a versioned support statement, not a guarantee for every later release or deployment; verify the current product, driver, and version documentation before implementation.
How do encryption keys fit in?
A common pattern is envelope encryption. A data-encryption key (DEK) encrypts the field value; a separate key-encryption key (KEK), also called a wrapping key, encrypts the DEK. The encrypted DEK can be stored or transmitted alongside the ciphertext, while the wrapping key remains under separate control in a key-management service, hardware security module, or equivalent system.
AWS describes this arrangement as encrypting plaintext with a data key and encrypting that data key under another key. MongoDB says CSFLE and Queryable Encryption use a unique data key for each encrypted field, with that data key encrypted by a customer master key. Keeping key authority separate from the ciphertext can reduce the chance that access to one store yields both data and the ability to decrypt it.
Rewrapping a data key under a new protector may avoid re-encrypting the underlying data, but the precise migration and recovery procedure depends on the SDK and stored data format. Design and test that procedure rather than assuming rotation is a one-step key replacement.
Rank #3
- TPM 2.0 (20pin-1)，Chipset:SLB9665,TPM 2.0 Module 20 pin Security Module Compatible with Gigabyte GA-Z170X-Gaming 3,GA-Z170X-Gaming 5,GA-Z170X-Gaming 7,GA-Z170X-Gaming G1,GA-Z170X-Gaming GT,GA-Z170MX-Gaming 5,GA-Z170X-UD3,GA-Z170XP-SLI ,GA-Z170X-UD5,GA-Z170X-UD5 TH,GA-Z170X-SOC FORCE,GA-Z170X-Designare,GA-Z170-HD3,GA-Z170-HD3P,GA-Z170-HD3 DDR3,GA-Z170-D3H,GA-Z170M-D3H,G1.Sniper Z170
- Precautions: This product is only applicable to older motherboards such as INTEL and AMD, and is not applicable to new motherboard models with firmware TPM, all-in-one computers, and laptops.
- Important: The minimum hardware requirements for upgrading to Windows 11 via TPM 2.0 are as follows: 1 GHz or faster 64-bit processor (dual-core/multi-core), 4 GB of memory, 64 GB of storage space, firmware that supports UEFI Secure Boot and TPM 2.0, DirectX 12-compatible graphics card, and a display with a resolution of 720p or higher.
- Purpose a: Resolve the TPM 2.0 verification issue when upgrading to Windows 11, enabling it to function as an independent encryption chip, providing secure storage for sensitive data, and enhancing security;
- Use b: Hardware encryption acceleration, such as improving game lag issues and other functions.
What are the query and compatibility trade-offs?
When a database receives ciphertext instead of a value, it cannot necessarily perform the same filtering, sorting, indexing, aggregation, or constraint checks it could perform on plaintext. The exact capabilities depend on the database, encryption mode, SDK or driver, and version. Establish the operations the workload requires before choosing an encryption feature.
MongoDB offers CSFLE and Queryable Encryption, but its documentation says they cannot be used in the same collection. Do not infer query support from the general phrase “field-level encryption”: verify supported operations, metadata exposure, performance characteristics for the actual workload, and compatibility across the specific product and driver versions.
AWS’s DynamoDB Database Encryption SDK makes a different set of boundaries explicit: applications select attributes, while attribute names and primary-key names and values remain unencrypted. Confirm whether those visible elements and the database operations they support are acceptable for the use case.
Quick Recap
How should you decide?
- Define the adversary. Decide whether the concern is storage theft, network interception, unauthorized database access, privileged database operators, or compromise of the application runtime.
- Mark the plaintext boundary. Identify which components may process each sensitive value in plaintext. If the database service must not see a selected value, encrypt it on the client before it crosses the database boundary.
- List required database operations. Write down the filters, sorts, indexes, aggregations, and constraints the application needs. Select an encrypted-query feature only after checking exact product and version support and the information it reveals.
- Choose key custody. Keep wrapping-key authority separate from stored ciphertext where practical. Define which application identities can use keys and what permissions they need.
- Plan for the full lifecycle. Specify rotation, retired-key retention for backup decryption, recovery, and migration procedures before production deployment.
- Reduce plaintext exposure. Limit how long decrypted values stay in memory, restrict logs and downstream copies, and apply access controls at the application, database, and key-management layers.
What should be in place before deployment?
- Remote key custody: MongoDB requires a remote KMS for production CSFLE. Keep keys out of source code and restrict key use to necessary identities.
- Rotation and recovery: OWASP’s Cryptographic Storage Cheat Sheet recommends having key rotation processes and retaining retired keys for a period when backups may still require decryption. Test recovery with the actual backups and data format.
- Separated storage: OWASP recommends separating keys from encrypted data where possible; HSMs, cloud key vaults, and external secrets-management systems are among the storage options it identifies.
- Visibility review: Document which values, keys, and metadata remain visible to the database and its operators, including unencrypted fields and primary-key information.
- Layered defenses: Use TLS for network protection, access controls for authorization, and at-rest encryption for persisted data as appropriate to the threat, even when selected fields are client-encrypted.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
