All news with #encryption at rest tag

🔐 This post examines how NICE Actimize reduced AWS KMS costs by 77% for a multi-tenant, event-driven platform by rethinking data key caching. It outlines the cache stampede problem that arises when envelope encryption operates at high concurrency and describes two solutions: the AWS-recommended hierarchical keyring with DynamoDB branch keys and a custom CachedKmsClient using Caffeine caches. The article covers design, trade-offs, and security considerations for both patterns.

🔒 Amazon RDS for SQL Server now supports restoring Transparent Data Encryption (TDE)-enabled databases to Multi-AZ instances and instances with a same-region read replica using native backup and restore. Previously, TDE restore was limited to Single-AZ, requiring disabling TDE or migrating to Single-AZ before restore. Back up your TDE certificate to Amazon S3, restore it to the RDS instance with the TDE option enabled, then restore the database backup from S3. This capability is available in all Regions where RDS for SQL Server is supported.

🔐 Amazon CloudWatch Synthetics now supports using customer managed AWS KMS keys to encrypt canary environment variables, allowing teams to control encryption for sensitive data such as API keys and tokens. Previously, only an AWS owned key was used; now you can specify a symmetric KMS key for at-rest encryption or perform client-side encryption and decrypt at runtime. This capability meets requirements for key management, auditability, and rotation and is available in all commercial AWS Regions, with multi-location canaries able to use per-replica Region keys.

🔒 The article explains the growing reality of “harvest now, decrypt later” attacks, where adversaries steal encrypted data today to decrypt later with quantum computers. It summarizes industry and government perspectives, noting that most organizations underprioritize the risk despite emerging standards like NIST’s 2024 post-quantum algorithms and EU transition roadmaps. The piece reviews mitigation options — PQC, QKD, and the need for cryptoagility — and highlights examples from Spain and financial institutions planning phased transitions.

🔒 UK Prime Minister Keir Starmer urged tech firms to implement device controls to block children from viewing or creating sexually explicit imagery, prompting CISOs to warn the plan could undermine enterprise encryption. Starmer gave companies three months to propose voluntary measures before pushing legislation; analysts caution on-device scanning is unlikely at scale and cloud processing would introduce new risks. Experts highlight logistical, performance, age-verification, and abuse risks that could create exploitable inspection vectors.

🔒 Amazon Quick Research now supports encryption using customer-managed keys (CMKs) via AWS Key Management Service, enabling organizations to control encryption, auditing, and key lifecycle. Customers can use multiple CMKs with one default key per AWS account per region and must create CMKs in the same account and region as Quick resources. Only symmetric KMS keys are supported, and CloudTrail integration provides comprehensive audit trails and the ability to revoke compromised keys within 15 minutes. The feature is generally available in all AWS Regions where Amazon Quick is offered.

🔐 Amazon Quick Research now supports customer-managed keys (CMKs) via AWS Key Management Service (KMS), enabling organizations to manage encryption keys for their Quick data. Customer-managed keys provide enhanced control, CloudTrail-based auditing, and the ability to revoke compromised keys within 15 minutes. Only symmetric KMS keys created in the same account and region are supported, with one default CMK per account per region and support for multiple CMKs across datasets.

🔒 Microsoft is evaluating a patch for a newly disclosed zero-day, YellowKey, which can bypass BitLocker encryption and allow local attackers to read and modify files. The company issued an advisory for CVE-2026-45585 and provided immediate mitigation guidance while a fix is considered. Organizations are urged to limit physical access to vulnerable devices, audit their environments, and strengthen Secure Boot and firmware integrity controls.

🔒 The AWS Advanced JDBC Wrapper now includes a KMS Encryption plugin that provides column-level client-side encryption for Java applications. Operating at the JDBC driver, the plugin encrypts values before they reach the database and decrypts on read, keeping plaintext visible only to the application while allowing HMAC-based integrity checks. It integrates with Aurora and RDS (PostgreSQL and MySQL-compatible), Spring, Hibernate, and common connection pools without code changes, and is available as open-source under the Apache 2.0 license.

🔒 Amazon OpenSearch Service now supports index-level encryption using AWS Key Management Service (KMS) customer managed keys. This allows you to assign different customer managed keys to individual indexes on the same domain, enabling more granular, tenant-specific encryption policies and isolating encrypted data across indexes. The capability builds on existing domain-level encryption and is available at no additional cost for domains running OpenSearch 3.3 or later in select AWS Regions.

🔐 Amazon S3 is rolling out a new default bucket security setting that will automatically disable server-side encryption with customer-provided keys (SSE-C) for all new general purpose buckets. For existing buckets in accounts without any SSE-C-encrypted objects, S3 will also block SSE-C for new write requests. AWS will not change buckets in accounts that already use SSE-C. The rollout covers 37 regions, including AWS China and GovCloud, over the next few weeks.

🏢 Amazon RDS for Oracle is now available on AWS Outposts, enabling customers to run a managed Oracle database service on-premises with the same operational model used in AWS Regions. The offering supports Oracle Database 19c and 21c under a BYOL model and includes automated backups, automated patching, point-in-time recovery, CloudWatch monitoring, and encryption at rest with AWS KMS. It also supports multi-AZ deployments across Outposts racks for high availability and provides options for disaster recovery to the parent AWS Region or across Outposts.

🔒 Amazon now supports FIPS-compliant operation for Amazon ECS Managed Instances running Graviton-based and GPU-accelerated workloads in the AWS GovCloud (US) Regions. ECS Managed Instances in GovCloud enable FIPS by default, use FIPS-compliant endpoints and validated cryptographic modules, and boot kernels in FIPS mode. Customers can enable the feature via the Console, ECS MCP Server, ECS Express Mode, or infrastructure-as-code; management charges apply in addition to EC2 costs.

🔒 HP announced TPM Guard, a hardware-plus-firmware solution introduced at its Imagine event, which creates an authenticated, encrypted tunnel between the TPM and the CPU to protect keys in transit. The design cryptographically binds the TPM to the host processor so the chip stops functioning if removed. HP says the feature thwarts low-cost physical attacks that can intercept TPM communications and will be available via firmware update on selected G2 commercial PCs starting in July, with broader integration in future models.

🔐 Amazon Redshift now supports federated permissions with AWS IAM Identity Center (IdC) across multiple AWS Regions, letting you extend IdC from a primary Region to additional Regions for improved proximity-based performance and resilience. In those Regions you can create Redshift and Lake Formation Identity Center applications without replicating identities, so existing workforce identities can query warehouses while row-, column-level and masking controls continue to apply automatically. Users benefit from single sign-on access via Amazon QuickSight, the Redshift Query Editor, or third-party SQL tools, simplifying access and compliance across regions.

🔐 Amazon Managed Grafana now supports customer-managed keys (CMKs) through AWS Key Management Service (KMS), enabling you to encrypt workspace data with keys you control. Previously, Amazon Managed Grafana used AWS-owned keys by default; this option lets organizations add a self-managed encryption layer to meet compliance and regulatory requirements. The feature is available in all generally available regions except AWS GovCloud (US) Regions.

🔒 Amazon Aurora now automatically applies server-side encryption by default to all new database clusters created without custom encryption settings, using AWS-owned keys. This fully managed encryption is transparent to users and incurs no cost or performance impact. Existing clusters are unaffected; you can still select customer-managed or AWS-managed KMS keys during creation. Available in all AWS Regions including GovCloud.

🔐 Google issues a call to action to protect digital systems against quantum threats, outlining its post-quantum cryptography (PQC) work and policy recommendations. The company warns that large-scale quantum computers could break current public-key cryptography and cautions about 'store now, decrypt later' harvesting of encrypted data. Google commits to research transparency, completing PQC migrations within NIST guidelines, and strengthening crypto agility, critical shared infrastructure, and ecosystem readiness.

🔐 Microsoft has the technical ability to release BitLocker recovery keys to the FBI when presented with appropriate court orders, a capability reportedly exercised roughly twenty times per year. While users can keep recovery keys only on their own devices, Microsoft advises storing them on its servers for convenience. That cloud backup simplifies recovery after lost credentials or device lockouts but also makes keys accessible to law enforcement through subpoenas or warrants.

🔐 Single-tenant Cloud HSM is now generally available in the U.S. and EU, offering dedicated, hardware-enforced key isolation for regulated workloads. It provides FIPS 140-2 Level 3 validated Marvell LiquidSecurity HSMs, quorum-based administration, and the ability to revoke Google access to make keys unavailable. Google manages provisioning and high availability while customers retain root key control and can provision clusters in minutes using gcloud.