Full-Disk Encryption and Protection of Data at Rest

Full-disk encryption protects all the information stored on a device by turning it into unreadable data without the corresponding key, so that even if the physical device is stolen or lost, the hard drive can't be read simply by removing it and plugging it into another computer. This matters in practice because a large number of corporate data breaches don't happen through a sophisticated remote attack, but through the physical loss of a laptop in a taxi, airport or café, an everyday scenario in which encryption at rest is the last effective line of defense. A key nuance is that disk encryption protects data when the device is off or locked, but doesn't replace other controls such as automatic screen locking or strong authentication, since an unlocked device in use exposes information in plain text regardless of whether the disk is encrypted.