Encryption in transit and at rest

TLS protects data moving over the network; disk and database encryption protect stored data. Both are expected by default today and nearly free in managed services.

Where it shows up in real systems

  • Key management service

    Envelope encryption keeps a master key in the KMS and encrypts data with short-lived data keys, so you do not call the KMS for every record.

    In production: AWS KMS, Azure Key Vault HSM, Google Cloud KMS

  • Service mesh

    Moves resilience and security out of application code into infrastructure, with uniform telemetry for every call. Each hop pays a little latency and the mesh itself is critical infrastructure to operate.

    In production: Istio, Linkerd, Consul Connect, AWS App Mesh, Cilium

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.

Open the learning path Open the sandbox