Greetings,
We'd prefer it if you didn't top-post (just write some stuff at the top)
when you respond and post to these mailing lists.
* laurent.feron@free.fr (laurent.feron@free.fr) wrote:
> I come back to your comments about vestor attacks. I know that TDE protects against disk thefts, not really more ..
That is a data-at-rest concern and TDE is one approach to addressing it.
> But compagnie has some internal rules and some of them require "At Rest" encryption, nothing more is mentionned.
> Then, even if TDE is not THE solution in term of security, it is something that companies want.
Disk-based encryption is available for basically all operating systems
and PostgreSQL works reasonably well on top of encrypted filesystems or
block devices. That's all available today, works quite well to deal
with the "someone stole the disk" or "someone forgot to wipe the drive
before throwing it away" attack vectors.
In particular, I'd encourage you to look at Linux with LUKS for data at
rest encryption. You can then simply run PostgreSQL on top of that and
be protected without any of the complications which TDE introduces.
Thanks,
Stephen
