1

I know there are laws which require all data to be encrypted in transit and at rest. It makes sense for browser to server connections but,

  • Does data flow within a VPC, lets say a kubernetes cluster needs to be encrypted too?
  • Does the data in transit between RAM and mounted volumes needs to be encrypted too?
  • If I am not encrypting the data in RAM, is that violating some laws?
Souradeep Nanda
  • 227
  • 2
  • 9
  • 1
    I'm not sure about laws that require these things. And we can't answer legal questions (and certainly not without knowing your jurisdiction). – schroeder Nov 15 '19 at 15:40
  • I have heard rumors about GDPR requiring zero trust networks. – Souradeep Nanda Nov 16 '19 at 03:46
  • I second schroeder, we can't answer this without a lot more detail. What country? What laws? What kind of data? For example, I don't think the government of Canada gives a toss whether the data streaming between by phone and my chromecast over my home wifi is encrypted. – Mike Ounsworth Nov 16 '19 at 04:33
  • If you have a specific law that you're looking at and wondering whether it applies to your situation, then you can quote the paragraph, and we can help you interpret it. Maybe somebody will surprise me with a great answer, but I think "Does anybody know of any laws in any country that cover this situation?" is too broad for a forum like this. – Mike Ounsworth Nov 16 '19 at 04:39
  • 1
    GDPR does not require any type of specific technology or approach. – schroeder Nov 16 '19 at 07:58
  • @schroeder Thanks this is what I was looking for. – Souradeep Nanda Nov 18 '19 at 04:19

1 Answers1

1

In general, you use a protection mechanism when there is a threat that you want to counter. So, if there is a threat within a cluster or between RAM and mounted volumes, then, yes, you should consider encryption.

schroeder
  • 129,372
  • 55
  • 299
  • 340
  • I am more worried about the legal, I am confident that my VPC is safe. – Souradeep Nanda Nov 16 '19 at 03:45
  • If you are only worried about the legal aspects, then this is off-topic. If your *real* question was about GDPR, then you've approached the question in a very weird way. – schroeder Nov 16 '19 at 08:07