Question

A privacy engineer is designing encryption for a database that stores customers' personal data at rest. Compliance requires that individual data encryption keys can be rotated frequently without re-encrypting the entire multi-terabyte dataset, and that a single compromised key exposes the smallest possible data set. Which encryption architecture best satisfies these requirements?

Accepted Answer

Envelope encryption, where data encryption keys (DEKs) encrypt the records and are themselves encrypted by a periodically rotated key encryption key (KEK) held in a key management service

Answer

Full-disk encryption using a single symmetric key managed by the storage platform, rotated annually during a maintenance window

Answer

Application-layer encryption using one shared static symmetric key hardcoded in the application configuration for all records

Answer

Transparent Data Encryption (TDE) with the master key stored in the same database instance as the encrypted data