Disk encryption
At rest is the disk. In transit is the path. Full-disk (FileVault, BitLocker, LUKS) protects a machine that left the building. It does not hide data from the running OS.
First principles
Encryption in transit protects a path: TLS, SSH, a VPN. Encryption at rest protects a store: a disk, an object, a database file. They answer different thefts. A packet sniffer on the path does not get a TLS session. A thief with the laptop in a bag does not get a FileVault volume. Mixing the two sentences up is how people 'encrypt' a disk and then serve the files in clear over HTTP.
Full-disk encryption — FileVault on macOS, BitLocker on Windows, LUKS on Linux — wraps the volume. When the machine is off (or the volume is locked), the thief has a brick. When the machine is on and unlocked, the OS sees cleartext. That is the design. It is stolen-laptop protection, not protection from malware that is already running as you.
Who can unwrap the key
On a laptop, the key is wrapped by the user's credential and usually a TPM. On a virtual machine, the hypervisor often holds a key that can unwrap the guest disk: snapshots, live migration, backup agents. That is still useful against the stolen-hosting-drive story. It is not useful against the hypervisor admin. Application-level encryption — the app wraps the data with a key the hypervisor does not have — is the next layer when the threat is the platform, not the bag.
What an admin actually does
- Turn on FileVault, BitLocker, or LUKS for every portable and every workstation that leaves a desk. Escrow recovery keys in a vault, not in a spreadsheet.
- Servers: encrypt volumes if the threat includes stolen disks or recycled hardware. Know whether the hypervisor can unwrap them.
- Do not confuse full-disk with 'the database is encrypted'. If the app can read it, so can anyone the app will talk to.
- In transit still needs TLS. Disk encryption does not cover the wire.
Informed by ASD's ACSC — ISM. Wording is ours.