The database is encrypted. The DBA still reads every SSN.

transcript

Your database is encrypted at rest. Box ticked. A DBA selects the SSN column. Every number, in plain text.

Transparent data encryption protects the disks and files. It decrypts automatically. No application changes. That's the transparent part. So anyone who can run a query gets plaintext. DBAs run queries.

So the most sensitive fields get encrypted in the application, before they're stored. The ID and email stay plain. You need them for queries and login. SSN, credit card, medical history: encrypted by the app.

Now a database admin can't read those fields. A leaked backup doesn't leak that PII. And it helps meet PCI and HIPAA requirements.

And who holds the keys? A master key, in a hardware security module. It never leaves. Under it, a key per tenant. Tenant A's key can't decrypt Tenant B's data. Under those, data keys. A compromised data key limits the blast radius.

Encryption at rest guards the disk. Field-level encryption guards the data. Even from your own admins.

Full breakdown in the lecture.