CIS-3.11 Encrypt Sensitive Data At Rest

• T1003 OS Credential Dumping — Encrypting sensitive data at rest prevents dumping credentials from OS caches, memory, or credential structures to obtain hashes or plaintext passwords on domain controller backups. • T1003.003 NTDS — NTDS dumping targets Active Directory credential material. Encryption and secure storage of DC backups can prevent an adversary who obtains an offline backup from directly accessing NTDS credential material. • T1005 Data from Local System — Encryption at rest directly reduces usability of stolen or accessed local data. • T1039 Data from Network Shared Drive — Encryption protects sensitive shared-drive data against unauthorized disclosure • T1119 Automated Collection — Adversaries use automated methods to search for and copy data across systems, cloud APIs, pipelines, or RAT functionality. Encryption at rest can mitigate the automated collection of files/storage objects from being usable when the adversary lacks access to the decryption key. • T1213 Data from Information Repositories — Repository encryption protects stored sensitive data even after unauthorized access. • T1530 Data from Cloud Storage — Cloud storage encryption directly protects sensitive stored cloud data. • T1550.001 Application Access Token — Application access tokens are sensitive credential material commonly stored in databases, configuration stores, browser profiles, caches, or application files. Encrypting those tokens at rest can prevent an adversary who obtains raw storage, a database backup, snapshot, or filesystem access from reading and reusing the tokens. • T1552 Unsecured Credentials — Credentials and authentication material are often stored within files, databases, configuration repositories, and application data stores. Encrypting sensitive data at rest reduces the usefulness of credential artifacts obtained from protected storage locations by preventing direct access to plaintext credential material. • T1552.004 Private Keys — Private keys are frequently stored on disk. Encrypting storage can reduce exposure from theft of key files, especially during offline access or storage compromise. • T1565 Data Manipulation — Adversaries insert, delete, or manipulate data to influence outcomes or conceal activity. Encrypting sensitive data at rest can prevent an adversary who lacks the decryption capability from understanding the protected content sufficiently to perform targeted or meaningful modifications, reducing the effectiveness of the manipulation. • T1565.001 Stored Data Manipulation — Adversaries modify stored data to affect outcomes or conceal activity. At-rest encryption may hinder offline manipulation where the adversary lacks the decryption key, but it does not prevent modification through an authorized application, database write access, or transparently decrypted storage • T1649 Steal or Forge Authentication Certificates — Certificates and private keys are commonly stored on disk. Encryption at rest can reduce exposure when attackers attempt to steal certificate material from storage.