Exercise 2: BitLocker and TDE Are Both "Encryption at Rest" — Possible Solution ==================================================================== WHAT THE TWO GENUINELY HAVE IN COMMON ------------------------------ Per this chapter's own compare-table, both decrypt "transparently" for the legitimate process meant to access the data - BitLocker "the moment Windows itself boots successfully on the original hardware," and TDE "the moment the database engine itself opens the file with its own key." Neither requires the legitimate user to manually decrypt anything each time - both are genuinely "encryption at rest" in the sense that the data sits encrypted on disk until the correct, expected process accesses it. WHY THEY PROTECT AGAINST GENUINELY DIFFERENT THREATS ------------------------------ Per the same table, BitLocker protects against "physical theft of the device or drive," while TDE protects against "direct filesystem/backup- file access bypassing the database engine entirely." BitLocker assumes the entire operating system and its boot process are the trust boundary - if Windows itself boots normally, the data is accessible. TDE assumes the database engine specifically is the trust boundary - even if the operating system and file access are otherwise unrestricted, someone reading the raw database file directly (rather than going through the engine) still can't make sense of it. WHY TREATING THEM AS INTERCHANGEABLE WOULD BE A MISTAKE ------------------------------ BitLocker on a database server's drive does nothing to stop someone with a valid OS-level login (or already-running access) from directly reading unencrypted database files through the filesystem, since once Windows has booted, BitLocker has already released its key and the drive appears fully readable to anything running on that machine. Only TDE closes that specific gap, since its own decryption is gated by the database engine, not by Windows having booted successfully. Conversely, TDE alone does nothing to stop someone who physically removes the drive entirely and connects it to different hardware before the database engine is ever involved - that's exactly the threat BitLocker is built to close instead. WHY THIS MATTERS PRACTICALLY ------------------------------ A system genuinely needing both threats covered - physical drive theft and direct file-level access bypassing the database engine - needs both protections layered together; assuming either one alone provides "encryption at rest" in the fullest sense leaves the other gap completely open. WHY THIS WORKS AS AN ANSWER ------------------------------ It states what both mechanisms share using this chapter's own table, identifies the specific different threat each is built to close, and gives a concrete scenario for each showing exactly why substituting one for the other would leave a real gap unaddressed.