ELI5: What's the difference between data encryption in transit and at rest for agents?

A common point of confusion in security reviews, especially for agent-based architectures (monitoring, security, backup, etc.), is the distinction between encryption in transit and at rest. While both are fundamental, they protect data in fundamentally different states and are governed by separate cryptographic controls. Understanding this is critical for crafting precise RFP requirements and vendor evaluation rubrics.

**Encryption in Transit**
This protects data while it is actively moving between systems over a network. For an agent, this is the communication channel between the agent process and its backend service or control plane.

* **Primary Goal:** Prevent eavesdropping (sniffing) or man-in-the-middle (MitM) attacks on the network link.
* **Typical Mechanism:** Transport Layer Security (TLS). The data is encrypted at the point of transmission and decrypted at the point of reception.
* **Key Management:** Relies on certificates (X.509) and asymmetric cryptography for handshake/authentication, then symmetric session keys for bulk encryption. These session keys are ephemeral.
* **Example for an Agent:** Your monitoring agent scrapes metrics from `localhost:9100`. When it sends these metrics to ` https://api.monitoring-vendor.com`, TLS ensures the packet payload is unreadable to any intermediary network device.

**Encryption at Rest**
This protects data while it is stored on a persistent medium—a disk, SSD, database, or even a local cache file on the agent's host.

* **Primary Goal:** Prevent data disclosure from physical theft, unauthorized disk access, or cloud storage compromise.
* **Typical Mechanism:** A symmetric encryption algorithm (like AES-256-GCM) applied to data before it is written to storage. The data remains ciphertext on disk.
* **Key Management:** The critical differentiator. The encryption key must be stored separately from the encrypted data. Often involves a Key Management Service (KMS) or a dedicated hardware security module (HSM).
* **Example for an Agent:** The same monitoring agent might buffer collected metrics in a local file (`/opt/agent/data/cache.db`) during a network outage. Encryption at rest would ensure this cache file is encrypted on the host's filesystem.

### Why This Matters in Procurement
When evaluating vendors for agent-based solutions, your RFP must demand clarity on both, as they are not interchangeable. A vendor stating "we use TLS" only addresses transit. Here are specific points for a scorecard:

* **In-Transit Rubric Criteria:**
* Mandate TLS 1.2 or 1.3, with a preference for TLS 1.3.
* Require certificate pinning or mTLS for agent-server communication, especially in high-security environments.
* Ask for supported cipher suites; eliminate vendors supporting weak ciphers (e.g., RC4, SHA1).

* **At-Rest Rubric Criteria:**
* Does the agent locally encrypt cached or queued data? If so, how are the encryption keys managed?
* For data stored in the vendor's backend, is encryption at rest applied? Is it provider-managed (e.g., cloud storage encryption) or customer-managed (bring-your-own-key)?
* Specify the required encryption standard (e.g., AES-256) and key rotation policy.

A robust vendor response will explicitly delineate their controls for each state. A vague answer like "all data is encrypted" is insufficient and should negatively impact their score in a formal evaluation.