Rest Layer.
At-rest crypto, accounted for.
The data that lives longest is most exposed to the harvest-now-decrypt-later threat. ResilQ inventories every encrypted volume, database and backup — and how its keys are managed.
Your archives have the longest shelf life.
Mosca's inequality is unforgiving here: if data needs to remain confidential for ten years, and Q-Day is conservatively estimated for 2034, then every archive encrypted with classical algorithms today is already overdue for migration. The Rest layer is where ResilQ spends most of its scoring weight.
Five vectors of at-rest exposure.
Full-disk encryption posture
- LUKS / LUKS2 — cipher mode (aes-xts-plain64), KDF, anti-forensic stripes
- dm-crypt configuration and key-slot inventory
- BitLocker — algorithm (AES-CBC, AES-XTS-128/256), TPM binding, recovery posture
- FileVault 2 — keychain bind, institutional recovery key presence
- ZFS native encryption with PBKDF2 → quantum-vulnerable KDF flag
Transparent Data Encryption
- PostgreSQL — pgcrypto, TDE forks, column-level encryption posture
- MS SQL — TDE algorithm, certificate management, key rotation cadence
- Oracle — TDE wallet, master-key rotation, tablespace coverage
- MySQL / MariaDB — innodb_encrypt_tables, keyring plugin selection
- MongoDB / Cassandra — encrypted-at-rest configuration, KMIP integration
Backup & archive
- Veeam — encryption flag, key location, KMS binding posture
- Bacula / Bareos — TLS PSK and storage-side AES posture
- Restic — repository password vs key-file mode, salt strength
- Borg — encryption mode (repokey, keyfile, blake2-authenticated)
- S3 SSE-S3, SSE-KMS, SSE-C — bucket policy and per-object enforcement
KMS & rotation
- Key types, sizes, custodianship and rotation evidence
- BYOK / HYOK / external-CMK posture across cloud KMS providers
- Vault transit-engine configuration and lease velocity
- Crypto-period compliance against your own policies
- Quantum-safe key wrapping availability per KMS
Cryptographic Bill of Materials,
generated automatically.
Every Rest-layer finding produces a row in your CBOM — a CycloneDX-compatible inventory of every algorithm, key size, KDF and rotation policy across the estate. Hand it to your auditor, regulator, or migration team unchanged.