ASVS 5.0 V11.7.1 (Level 3) requires full memory encryption so sensitive data stays protected while it is in use, blocking access by unauthorized users or processes, including privileged ones on the host.
Why it matters
Encryption at rest and in transit leaves a gap: the moment data is decrypted for processing, it sits in plain memory. A compromised host, a hostile hypervisor or a memory dump can read it.
How to implement it
Run sensitive workloads on confidential computing platforms that encrypt memory in hardware, such as AMD SEV SNP, Intel TDX or other trusted execution environments offered by your cloud. Choose the confidential VM or container option, and enable remote attestation so your app releases keys only to an environment that proves its state.
How to test it
Check the instance type and boot attestation report from your provider. Verify in the cloud console or API that memory encryption is on, and that key release is gated on a valid attestation.
Common mistakes
- Assuming disk encryption covers memory
- Enabling the feature but skipping attestation
- Leaving swap or core dumps unencrypted
Quick check
Which layer does V11.7.1 add beyond at rest and in transit?
Protection of data while in use in memory.
