Your database is encrypted at rest. An attacker obtains valid application credentials. What does the encryption protect against?

What is being tested

Whether you can state which threat a control actually addresses. At-rest encryption is the most frequently over-claimed control in architecture reviews.

The reasoning

Provider-managed disk and database encryption decrypts transparently for anything with legitimate access. An attacker holding valid application credentials asks the application for the data, the application asks the database, and the database returns it decrypted. The encryption is doing exactly what it was designed to do and is irrelevant to this attack.

What it does protect: a drive removed from a data centre, a disk sold without wiping, a backup file copied from storage without the corresponding key access. Real threats, narrow ones.

The discipline is to state the threat next to the control. "The database is encrypted" is not a security property; "encrypted with provider-managed keys, protecting against media theft" is, and it makes the gap visible.

What would have protected against this attack

Application-level encryption, where data is encrypted before it reaches the database with keys the database cannot access, and decryption requires a separate authorisation. Genuine protection, with a genuine cost: you lose the ability to index, search or sort those fields, which frequently rules it out for anything but the most sensitive columns.

Least-privilege credentials. The application credential should reach only the data that application needs, so a compromise is bounded.

Short-lived credentials, so a leaked one expires.

Anomaly detection on access patterns, since a compromised credential usually behaves differently from a legitimate one — bulk reads, unusual hours, unusual source.

Egress control, because exfiltration is what turns an intrusion into a breach, and egress is usually the least controlled path.

The key management points that matter more than the cipher

• Where keys live — a managed key service or an HSM, never in code or environment variables, which is the most common real finding.
• Who can use a key — the key's access policy is the real access control on the data.
• Envelope encryption, so rotating a master key does not require re-encrypting the data.
• Handling multiple key versions simultaneously, or rotation is impossible in practice and therefore never happens.
• Key recovery. Losing a key is unrecoverable data loss, so key backup needs as much care as the encryption itself.

What a strong answer adds

Noting that at-rest encryption is still worth having — it is cheap, it satisfies compliance requirements, and it addresses a real threat. The failure is not in enabling it; it is in citing it as protection against threats it does not touch, which leaves the actual gap unaddressed.