Missing Encryption at Rest
Sensitive data stored without encryption is vulnerable to disclosure through database breaches, backup theft, or unauthorized file access. This includes passwords stored in plaintext, unencrypted PII, and sensitive configuration data.
Overview
Data encryption at rest protects sensitive information stored in databases, file systems, and backups. Without encryption, a database breach, stolen backup, or compromised server gives attackers direct access to all stored data including credentials, PII, financial records, and proprietary information.
Impact
Mass data breach, credential compromise, regulatory penalties, identity theft.
Remediation
Encrypt all sensitive data at rest using AES-256, hash passwords with bcrypt/argon2, encrypt database backups, and implement proper key management.
Encrypt all sensitive data at rest using AES-256
Hash passwords using bcrypt or Argon2 (never MD5/SHA1)
Use transparent database encryption (TDE)
Encrypt all backup storage
Implement centralized key management with rotation
Related SuperClue scanner checks
These scanner checks look for signs of Missing Encryption at Rest. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works