0Pricing
Cyber Security Academy · Lesson

Access Control and Encryption

Protect data at rest.

Access Control and Encryption is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Protecting Data at Rest

Databases hold the crown jewels, so two controls matter most: access control (who can touch the data) and encryption (making the data useless if stolen).

Together they protect data both while the system runs and if disks or backups are exfiltrated.

Authentication vs Authorization

Keep the two ideas distinct:

  • Authentication proves who you are (login, certificate, IAM token).
  • Authorization decides what you may do once identified.

Strong database security needs both: verified identities and tightly scoped permissions.

Principle of Least Privilege

Grant each account only the permissions it needs, and nothing more. A reporting service should be read-only; an app writer should not be able to DROP tables.

CREATE ROLE report_reader;
GRANT SELECT ON sales.* TO report_reader;
GRANT report_reader TO 'analytics_svc'@'%';

Role-Based Access Control

RBAC groups permissions into roles and assigns roles to users. This scales better than granting privileges per user and makes audits clear.

  • Define roles: read_only, app_writer, dba.
  • Assign users to roles.
  • Review role membership regularly.

Row and Column Level Security

Fine-grained control limits access within a table.

  • Column-level: hide salary or SSN columns from some roles.
  • Row-level security (RLS): a tenant only sees its own rows.
-- PostgreSQL row-level security
ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON orders
  USING (tenant_id = current_setting('app.tenant')::int);

Encryption at Rest

Encryption at rest protects data on disk. If someone steals the drive or a backup file, the contents are unreadable without the key.

Options include full-disk encryption, filesystem encryption, and database-native Transparent Data Encryption (TDE).

Transparent Data Encryption

TDE encrypts the database files automatically. Applications need no changes; the engine encrypts on write and decrypts on read. It defends against stolen files but not against an attacker who already has a valid DB session.

-- SQL Server example concept
CREATE DATABASE ENCRYPTION KEY
  WITH ALGORITHM = AES_256
  ENCRYPTION BY SERVER CERTIFICATE tde_cert;
ALTER DATABASE appdb SET ENCRYPTION ON;

Column-Level Encryption

For especially sensitive fields (card numbers, health data) encrypt individual columns. The plaintext never sits in the database, even for a DBA.

Trade-off: encrypted columns are hard to index and search, so apply it selectively.

Encryption in Transit

Data also needs protection on the wire. Require TLS for all client-to-database connections so credentials and result sets cannot be sniffed.

-- PostgreSQL: force SSL in pg_hba.conf
hostssl  appdb  webapp  0.0.0.0/0  scram-sha-256
-- reject non-TLS:
hostnossl appdb all 0.0.0.0/0 reject

Key Management

Encryption is only as strong as its key handling. Never store keys next to the data they protect.

  • Use a Key Management Service (KMS) or HSM.
  • Rotate keys on a schedule.
  • Separate duties: the DBA should not also hold the master key.

Putting It Together

A layered model for data at rest:

  • Authenticate every connection (TLS + strong credentials).
  • Authorize via RBAC and least privilege.
  • Apply RLS/column security for fine-grained needs.
  • Encrypt at rest (TDE) and sensitive columns specifically.
  • Manage keys in a KMS, separate from the database.

Quick Check

Reason about what each control protects against.

Recap

Data at rest is protected by combining access control and encryption:

  • Distinguish authentication from authorization.
  • Apply least privilege and RBAC, plus row/column security when needed.
  • Encrypt at rest (TDE, column-level) and in transit (TLS).
  • Manage keys separately in a KMS and rotate them.

Frequently asked questions

Is the “Access Control and Encryption” lesson free?

Yes — the full text of “Access Control and Encryption” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Access Control and Encryption”?

Protect data at rest. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Access Control and Encryption” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. SQL Injection Defense
  2. Access Control and Encryption
  3. Auditing and Monitoring
  4. Backup and Recovery Security
← Back to Cyber Security Academy