Encryption is the single most reliable technical control your business can apply to reduce the damage of a cloud data breach. This guide covers both data at rest and data in transit in one place, walking you through algorithm selection, key management, platform-specific configuration on AWS and Azure, and compliance alignment — so you can audit your current setup and act on any gaps today.
Key Takeaways
- Use AES-256 for data at rest and TLS 1.3 for data in transit — these are the current minimum acceptable standards.
- Never store encryption keys alongside the data they protect. Use AWS KMS, Azure Key Vault, or Google Cloud KMS.
- Cloud providers don’t always enable encryption by default on every service — verify your settings, don’t assume coverage.
- Rotate encryption keys on a defined schedule and audit all key access events.
- Encryption works alongside access controls and monitoring — it reduces breach risk, it doesn’t eliminate it.
What Cloud Data Encryption Is and Why It Matters
Cloud encryption is the process of converting readable data into an unreadable format using a mathematical algorithm. Only someone with the correct decryption key can reverse the process and read the original data. Without encryption, a breach exposes raw customer records, financial data, and credentials to anyone who gains unauthorized access — there’s no second line of defense once the perimeter fails.
Cloud encryption applies to two distinct states your data occupies at any given moment: at rest (stored in databases, file systems, or backups) and in transit (moving between your users, your applications, and cloud services). Protecting one state without the other leaves a gap attackers can exploit.
Data at Rest vs. Data in Transit: Understanding the Difference
What Is Data at Rest?
Data at rest refers to files, database records, and backups sitting in cloud storage — think Amazon S3 buckets, Azure Blob Storage, or database volumes attached to virtual machines. The risk is that an attacker who gains access to the storage layer, or a misconfigured permission that exposes a bucket publicly, can read everything stored there if it isn’t encrypted.
What Is Data in Transit?
Data in transit is data actively moving: between a user’s browser and your cloud application, between microservices inside your cloud environment, or between cloud regions during replication. Unencrypted data in transit can be intercepted through techniques like man-in-the-middle attacks, especially on shared or poorly secured networks.
Choosing the Right Encryption Algorithm
Is AES-256 Good Enough for Cloud Storage?
Yes. AES-256, which stands for Advanced Encryption Standard with a 256-bit key, is the current standard for encrypting data at rest. A 256-bit key means there are 2^256 possible combinations — a number so large that brute-force attacks are computationally infeasible with any technology available today. NIST (the National Institute of Standards and Technology) endorses AES-256 under its FIPS 140-2 and FIPS 140-3 publications, making it the appropriate choice for regulated industries.
What TLS Version Should I Use?
For data in transit, use TLS 1.3. TLS, or Transport Layer Security, is the protocol that encrypts data moving across networks. Version 1.3 is faster and more secure than its predecessors, removing support for weak cipher suites that older versions allowed. TLS 1.2 is still acceptable in many environments, but TLS 1.0 and 1.1 are deprecated by NIST and disabled by default on most major cloud platforms.
Avoid these algorithms entirely: DES, 3DES, RC4, and any configuration that allows TLS 1.0 or 1.1. These are considered broken by current cryptographic standards and are prohibited under PCI-DSS version 4.0.
Encryption Key Management Best Practices
Strong encryption with poor key management is still a vulnerability. The encryption key is what makes your data readable — if an attacker obtains the key, the algorithm doesn’t matter. Key management is where many organizations underinvest, and it’s where breaches often originate.
Where Should Encryption Keys Be Stored?
Never store encryption keys in the same environment as the data they protect. If a key lives next to the encrypted data, an attacker who accesses one gets both. Use a dedicated key management service: AWS KMS (Key Management Service), Azure Key Vault, or Google Cloud KMS. These services store keys in hardware security modules (HSMs), which are tamper-resistant physical devices that prevent key extraction even by cloud provider employees.
Key Management Options Compared
| Option | Control Level | Complexity | Best For |
|---|---|---|---|
| Provider-managed keys | Low | Low | SMBs with no compliance mandate |
| Customer-managed keys (CMK) | High | Medium | HIPAA, PCI-DSS, GDPR environments |
| Bring Your Own Key (BYOK) | Full | High | Enterprise or strict data sovereignty requirements |
Key Rotation and Access Controls
Rotate encryption keys on a defined schedule — annually at minimum, or immediately after any suspected compromise or significant personnel change. Key rotation means generating a new key and re-encrypting data with it, so that old keys become useless over time. Limit which people and systems can access keys using role-based access control (RBAC), and audit every key access event. AWS KMS and Azure Key Vault both provide detailed access logs you can feed into your security monitoring tools.
What AWS and Azure Provide by Default
AWS Encryption Defaults
AWS offers server-side encryption (SSE) for S3 buckets, but the default behavior has varied across bucket types and creation methods. You can enforce SSE-KMS across all new buckets using S3 bucket policies and AWS Organizations service control policies. AWS KMS handles key management, and you can choose between AWS-managed keys or customer-managed keys depending on your control requirements. Don’t assume a bucket is encrypted — verify the encryption settings on each bucket in your account.
Azure Encryption Defaults
Azure Storage Service Encryption is enabled by default for all new storage accounts. Azure Key Vault manages keys and supports both Microsoft-managed and customer-managed key options. The distinction matters for compliance: if your auditor requires proof that your organization controls the encryption keys, customer-managed keys through Azure Key Vault are the appropriate configuration. Azure also lets you enforce minimum TLS versions at the storage account level, which you should set to TLS 1.2 or higher.
“Available by default” doesn’t mean “configured correctly for your use case.” Audit your settings on each cloud service individually rather than assuming platform-level defaults cover every workload.
Encrypting Data in Transit: Configuration Steps
- Enforce TLS 1.3 on all external endpoints. In AWS, configure minimum TLS versions through CloudFront distributions and Application Load Balancer (ALB) security policies. In Azure, set the minimum TLS version in App Service TLS settings and storage account configuration.
- Disable TLS 1.0 and 1.1 at the load balancer or API gateway level. Both AWS and Azure allow you to select security policies that exclude older protocol versions.
- Encrypt internal traffic too. Data moving between services inside a VPC or Azure Virtual Network is still at risk if intercepted. Apply TLS to service-to-service communication, not just public-facing APIs.
- Check TLS certificate expiration dates. An expired certificate can force fallback to insecure connections. Set automated renewal alerts or use AWS Certificate Manager and Azure-managed certificates to handle renewals automatically.
Compliance Frameworks and Encryption Requirements
NIST SP 800-111 covers storage encryption for sensitive data, and SP 800-52 defines approved TLS configurations for federal and regulated environments. Both documents align with AES-256 and TLS 1.3 as the current acceptable standards.
HIPAA requires encryption of protected health information (PHI) at rest and in transit under its Technical Safeguard requirements. PCI-DSS requires strong cryptography for cardholder data and explicitly prohibits TLS 1.0. GDPR doesn’t mandate a specific algorithm, but it treats encryption as a recognized technical safeguard — organizations that encrypt data may have reduced breach notification obligations when a breach occurs on encrypted data that an attacker can’t read.
Common Cloud Encryption Mistakes to Avoid
- Assuming the cloud provider handles everything. Default settings vary by service, region, and account configuration. Verify encryption status on every storage bucket, database, and data pipeline in your environment.
- Storing keys alongside encrypted data. This negates the protection entirely. Use a dedicated key management service.
- Skipping encryption for “non-sensitive” internal data. Attackers who gain internal network access can intercept unencrypted traffic between services. Encrypt internal traffic as a standard practice.
- Never rotating keys. A key that hasn’t been rotated in years represents long-term exposure, particularly after staff changes or access policy updates.
- Ignoring the shared responsibility model. Cloud providers secure the underlying infrastructure; you’re responsible for configuring encryption on the services you deploy.
Your Next Steps for Stronger Cloud Encryption
Start by auditing your current cloud provider’s encryption settings: check every S3 bucket or Azure storage account for SSE status, verify your TLS minimum version enforcement, and confirm whether you’re using provider-managed or customer-managed keys. If you’re subject to HIPAA, PCI-DSS, or GDPR, cross-reference your current configuration against the specific requirements of your applicable framework and document what you find.
If you want to go deeper on cloud security fundamentals, explore our related guides on cloud security for small business and choosing a cloud provider with strong security controls. You can also subscribe to the speakingofclouds.com newsletter for practical cloud security guidance delivered monthly to IT managers and business owners.
Frequently Asked Questions
What is the difference between data at rest and data in transit?
Data at rest is stored data sitting in databases, file systems, or backups. Data in transit is data actively moving between systems, users, or cloud regions. Both require encryption because a breach can occur at either point.
Does my cloud provider encrypt data automatically?
Some services enable encryption by default, but not all. AWS S3 and Azure Blob Storage have default encryption options, but you need to verify settings on each service and storage account individually. Don’t assume full coverage without checking.
What encryption algorithm should I use in 2026?
Use AES-256 for data at rest and TLS 1.3 for data in transit. These align with NIST guidelines and meet the requirements of HIPAA, PCI-DSS, and most other compliance frameworks.
How do I encrypt data in the cloud?
Enable server-side encryption on your storage services, configure TLS 1.3 on all endpoints, and use your cloud provider’s key management service (AWS KMS, Azure Key Vault, or Google Cloud KMS) to manage encryption keys separately from your data.
What is BYOK in cloud encryption?
BYOK stands for Bring Your Own Key. It lets your organization generate encryption keys outside the cloud provider’s environment and import them into the provider’s key management service. This gives you full control over key material, which some compliance frameworks require.
How often should I rotate encryption keys?
Rotate keys at least annually. Also rotate immediately after any suspected compromise, significant personnel change, or major access policy update. AWS KMS and Azure Key Vault support automated key rotation to reduce manual overhead.
Is encryption enough to protect my cloud data?
Encryption is one layer of protection, not a complete solution. It works alongside access controls, identity management, network monitoring, and incident response. Together, these controls reduce the likelihood and impact of a breach.
- Cloud Encryption Best Practices: Protecting Data at Rest and in Transit - September 1, 2026
- Best Neocloud Provider: Top GPU Cloud Platforms Ranked by Time to Revenue - August 25, 2026
- Best Enterprise ITFM Solutions: Top 5 Picks for IT Finance Leaders in 2026 - August 17, 2026