Encrypting MySQL Data at Rest

Encryption at rest protects data stored on disk if the physical storage or a backup is ever accessed outside normal application channels — a meaningful defense-in-depth layer, though not a substitute for proper access controls.

-- Enable encryption for a specific table's tablespace (InnoDB)
CREATE TABLE sensitive_data (
    id INT PRIMARY KEY,
    ssn VARCHAR(20)
) ENCRYPTION='Y';

-- Check which tables are encrypted
SELECT table_name, create_options
FROM information_schema.tables
WHERE create_options LIKE '%ENCRYPTION%';

Full Disk vs Column-Level Encryption

MySQL’s tablespace encryption (shown above) protects data if the disk itself is stolen or improperly disposed of, but the database can still read the data normally once running — it does not protect against a compromised application or a malicious DBA. For truly sensitive fields (like payment data), application-level encryption of specific columns before they ever reach MySQL adds a genuinely separate layer.