Data encrypted at rest may become accessible in memory during use. Assess secret lifetimes, copies and critical decisions that depend solely on a memory value.
Evaluation approach
Runtime protection can produce interference signals. Retain business authority on the server and reduce the time sensitive data remains in memory.
Application example
Changing a displayed balance must not permit spending independently of server records. Also match the amount shown with the amount processed.
Limits and considerations
A claim of memory encryption does not prove that processed data is inaccessible at every moment.
Storage security and data in use
Encryption on disk does not explain how data is handled in memory. Keep sensitive values short-lived and narrowly scoped where possible. Do not promise absolute secrecy when the threat model places the client process under attacker control.
Revalidate business decisions such as authority and amount on the server. RASP may detect interference, but final transaction acceptance must depend on independent server rules. Test which outcome a particular data change can influence.
Checks and decisions
- Keep authority on the server
- Minimize temporary data
- Verify transaction fields
Protect local data while maintaining business rules independently of that protection.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.