Encryption at rest/in transit

[Aryeh Friedman]

On Thu, Apr 9, 2020 at 11:41 PM Kudiwu, Grace S. (Prosphere) via
freebsd-questions <freebsd-questions at freebsd.org> wrote:

> How does FreeBSD handle encryption of data at rest and data in transit?
>

Speaking as some who builds HIPAA complaint (requires end-to-end encryption
by law) software on FreeBSD I will say the following in regards to your
question:

1. Encryption is not, per se, an OS issue for the most part it is how you
make your application and the transport mechanisms you use.  For example if
you are not using TLS/SSL then no matter how the OS stores data the
transport is not encrypted and no feature of the OS can change that fact.
Conversely if you using TLS/SSL then the transport is encrypted regardless
of the OS

2. FreeBSD does support encrypted drives but this should *NOT* be
considered encrypt at rest because it only protects the data from physical
theft and reading on a different system then it was created on (and
depending on configuration makes it so you must know a password to
successfully boot the machine [not a good idea for data center based
servers]).

3. Due to item three you should use application level encryption on
storage.   Very few applications truly support this for example no widely
DB that I know of supports record/table level encryption.   Field
encryption is not the same since it allows someone to see the scheme and
the first rule of good security is give the attacker as little information
as possible.

-- 
Aryeh M. Friedman, Lead Developer, http://www.PetiteCloud.org