Encrypting all data at rest
Encrypting your data in motion is great, but you also need to encrypt the data at rest. This is especially important in the cloud, where you are sharing storage with many other users. While your cloud provider may offer automatic encryption, it is important to remember that if they can decrypt the data automatically, they also have access to the keys. To truly protect your data, you need to encrypt the data with keys that your cloud does not have access to. This can be done easily with Linux Unified Key Setup (LUKS). Large organizations will also want to use Clevis, which enables the automatic decryption of data from keys managed by a Tang server. The Tang server is used to store and manage the encryption keys. In the cloud, this allows you to manage your boot encryption without the cloud provider having access to your keys. This process is called Network Bound Disk Encryption (NBDE).
NBDE is a security feature used in Oracle Linux that provides disk...
