zakirkun Unencrypted Database
Overview
Databases storing sensitive data must be encrypted both at rest (disk encryption) and in transit (TLS). Without encryption at rest, physical access or cloud storage access exposes all data. Without TLS, credentials and data can be intercepted on the network.
Remediation
- Enable TLS/SSL in database connections (
sslmode=requirefor PostgreSQL) - Use encrypted database volumes (AWS RDS encryption, cloud disk encryption)
- Use SQLCipher for SQLite encryption