Encryption At Rest: Whose Threat Model Is It Anyway?

This post discusses the importance of encryption at rest in web and cloud applications and the need for a clear threat model. It explores the concept of security theater and the risks it aims to mitigate. The post also explains client-side encryption and the need for proper key management and encryption algorithms. It highlights the issue of confused deputies and offers solutions to mitigate the risk. The post concludes by urging developers to improve their understanding of encryption at rest and engage in threat modeling.