Don't Panic: Database Encryption and Key Management

Database encryption turns readable data into ciphertext. Key management controls who can reverse that transformation. Treat them as one system. Strong encryption with exposed, lost, or overpowered keys is like locking the vault and taping the combination to the forklift.

Start with the threat and the boundary. Storage encryption protects a lost disk or copied volume. Transparent data encryption protects database files and covered logs or backups while the running engine still sees plaintext. Field, proxy, and client-side encryption can protect selected values from more of the database path, but they may also break normal query behavior.

The central pattern is envelope encryption. A data-encryption key protects the data. A key-encryption key wraps that data key. The wrapped data key can live near the ciphertext, while the wrapping key stays in a key manager, vault, or hardware security module. Metadata ties ciphertext to the correct key version, purpose, owner, and protection method.

Rotation has several jobs. Rewrapping changes the key that protects a data key without rewriting the bulk data. Re-encryption changes the data key association and touches ciphertext. Old key versions remain necessary until every database, log, replica, snapshot, export, and backup has migrated or expired.

Recovery is the test people skip when optimism is cheaper. An encrypted backup may need certificates, wallets, key-manager access, network paths, permissions, and audit controls. A backup job proves bytes moved. A restore proves the organization can still read them.

Use the Practice Reference to record threats, plaintext boundaries, key hierarchy, rotation, and restore evidence. Do the Exercise to design protection for customer data. The Cheatsheet keeps layers, authorization, query effects, and failure modes visible. The strongest design is the one whose key path matches the threat model and whose recovery path has actually worked.

Don't Panic: Database Encryption and Key Management

Relevant careers