Data Encrypt at Rest

In Oracle Cloud Infrastructure (OCI), data is always encrypted both at rest and in transit: at rest using AES‑256 encryption, and in transit using TLS protocols. The key difference is that encryption at rest protects stored data from unauthorized access if storage is compromised, while encryption in transit ensures data cannot be intercepted or altered while moving across networks.

🔒 Data Encryption in OCI

1. Data at Rest

Definition: Data stored on physical media (block volumes, object storage, file storage, databases).

Mechanism:

• AES‑256 encryption is applied automatically to block volumes, boot volumes, and object storage.

• File storage is encrypted at rest and access is controlled via IAM and network security groups.

Key Management:

• Oracle-managed keys (default, simple, compliant).

• Customer-managed keys (greater control, custom rotation).

Use Case: Protects against theft or unauthorized access if disks, backups, or storage devices are compromised

2. Data in Transit

Definition: Data actively moving between client devices, OCI services, or across networks.

Mechanism:

• TLS (Transport Layer Security) with strong ciphers ensures confidentiality and integrity.

• HTTPS, VPNs, and secure APIs are used for communication.

Protection: Prevents interception, tampering, or man-in-the-middle attacks during transmission.

Use Case: Ensures secure communication between OCI services, user applications, and external endpoints

📊 Comparison Table