← VCE Software Development U4O2

Encrypting data at rest and in transit

Encrypting data both while stored (databases, backups) and while moving over a network (TLS), so intercepted or stolen data stays unreadable without the key.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 60, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 145, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 49, QCE Digital Solutions Unit 2 — Data and Programming Techniques — Module 116, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 9

Understanding Encrypting data at rest and in transit in VCE Software Development U4O2

What it does: Fetching the key from a secrets vault keeps it away from the encrypted database, so stealing the data does not also give the attacker the key. Rejecting plain HTTP stops data travelling in readable form where a man-in-the-middle could capture it. Data at rest is data stored on a disk, in a database or in a backup. Encrypting it means a stolen file is unreadable without the key. Data in transit moves across a network. TLS encrypts the connection, which defends against interception such as man-in-the-middle attacks. If the key is stored with the data, an attacker who steals one gets both. Keys must be stored separately and protected with strict access.

Common mistakes: Data must be encrypted before it is stored in the database (encryption at rest). Calling decrypt on plain data does not protect it. Line 2 should use encrypt(data, key). HTTP sends data as plain text, so an attacker on the network could read the card number. Encryption in transit needs HTTPS (TLS), so the protocol should be "HTTPS".

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Encrypting data at rest and in transit to a class →

This module's key terms are also in a printable crossword (Modules 49–72) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A student app stores user emails in a database on a server. Which type of encryption protects the emails if someone steals the database file?
Encryption at restEncryption in transit
Matches
db.save(password_plaintext) // encrypt only on login page
↓
Data is stored unencrypted, so only data in transit is protected. Stored data at rest must be encrypted too.
Applying
Meanings
Term
Encryption at rest and in transit
Meaning
Encrypting data both while stored (databases, backups) and while moving over a network (TLS), so intercepted or stolen data stays unreadable without the key.
Practice
key ← GET_KEY_FROM_VAULT("db-key")
Testing
Gaps
encrypted = (record, key)
Check Answer
Spots
1BEGIN saveCustomerData
2 encrypted ← decrypt(data, key)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Puffin' badge — Definition Diver, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A student app stores user emails in a database on a server. Which type of encryption protects the emails if someone steals the database file?
A. Encryption at rest ✓
B. Encryption in transit
Data at rest is data stored on a disk, in a database or in a backup. Encrypting it means a stolen file is unreadable without the key.
2. A login form sends a password from a phone to a server across public Wi-Fi. Which protection stops an attacker on that network from reading it?
A. Encryption in transit using TLS (HTTPS) ✓
B. Encryption at rest on the server's disk
Data in transit moves across a network. TLS encrypts the connection, which defends against interception such as man-in-the-middle attacks.
3. True or false: Encrypting a database means the data no longer needs to be protected when it is sent to another system.
A. True: encrypted storage also covers data sent over a network
B. False: data needs protection both at rest and in transit ✓
Encryption at rest only protects stored data. Once the data is sent over a network, it needs an encrypted connection such as TLS.
4. A company backs up its customer database to an external drive that is taken off-site. What should it do to protect the backup if the drive is lost?
A. Encrypt the backup file ✓
B. Rely on the database's login password only
Backups are data at rest and are often less protected than the live database. Encrypting them keeps lost or stolen copies unreadable.
5. Where is the safest place to keep the key that decrypts an encrypted database?
A. In a text file next to the encrypted database
B. In a separate, access-controlled key store ✓
If the key is stored with the data, an attacker who steals one gets both. Keys must be stored separately and protected with strict access.

Match the Pairs

AES-256 encrypt database column → Protects data at rest so stolen database files or backups cannot be read without the key
fetch('https://api.shop.com/orders') → Protects data in transit because TLS encrypts the connection between client and server
Encryption keys must be protected by keeping them separate from the data they encrypt → key = vault.get_secret('DB_KEY')
Defence against interception: refuse unencrypted connections and only allow encrypted ones → if (request.protocol != 'https') { reject(); }
db.save(password_plaintext) // encrypt only on login page → Data is stored unencrypted, so only data in transit is protected. Stored data at rest must be encrypted too.
ENCRYPTION_KEY = 'abc123' // saved in app.js with the encrypted backup → The encryption key is hard-coded and stored beside the encrypted data, so anyone who steals the backup also gets the key.

Key Term

Encryption at rest and in transit
Encrypting data both while stored (databases, backups) and while moving over a network (TLS), so intercepted or stolen data stays unreadable without the key.

Fill in the Blanks

1. encrypted = ENCRYPT(record, key) SAVE encrypted TO database
Hint: Type the function name that scrambles data before it is stored, protecting it at rest.
2. url = "https://shop.example.com/pay"
Hint: Type the protocol scheme that wraps web traffic in TLS so data is protected in transit.
3. import os key = os.getenv("DB_KEY")
Hint: Type the function that reads the encryption key from the environment instead of hard-coding it in source code.
4. IF NOT connection.encrypted THEN BLOCK send(data) END IF
Hint: Type the logical operator that reverses the condition so unencrypted connections are caught and blocked.
5. r = requests.get(url, verify=True)
Hint: Type the Boolean value that keeps certificate checking switched on to defend against interception.

Spot the Error

Question 1
A BEGIN saveCustomerData
B encrypted ← decrypt(data, key)
C WRITE encrypted TO database
D END
Line B — Data must be encrypted before it is stored in the database (encryption at rest). Calling decrypt on plain data does not protect it. Line 2 should use encrypt(data, key).
Question 2
A BEGIN sendPayment
B SET protocol TO "HTTP"
C SEND cardNumber
D END
Line B — HTTP sends data as plain text, so an attacker on the network could read the card number. Encryption in transit needs HTTPS (TLS), so the protocol should be "HTTPS".
Question 3
A BEGIN backupDatabase
B dump ← EXPORT(database)
C locked ← encrypt(dump, key)
D SAVE dump TO backupDrive
E END
Line D — The backup is encrypted in line 3 but the unencrypted dump is saved instead. If the backup drive is stolen the data is readable. It should save the encrypted version: SAVE locked TO backupDrive.
Question 4
A BEGIN startApp
B DECLARE key
C key ← "Secret123"
D encrypt(data, key)
E END
Line C — Hard-coding an encryption key in the source code exposes it to anyone who can read the code or repository. The key should be loaded from a secure key vault: key ← READ keyVault.
Question 5
A BEGIN setupDatabase
B DISABLE encryptionAtRest
C SET cipher TO "AES-256"
D END
Line B — Turning off encryption at rest leaves stored records readable if the database files are stolen. The setup should ENABLE encryptionAtRest.

Student with a class code? Join your class →