What is the best way to protect data at rest?

Encryption is the most effective way to protect data at rest. Classification is useful to ensure data is handled in appropriate ways, but does not directly protect the data. Segmentation can help keep data in the right locations with appropriate controls around it, but again does not directly protect the data if the server or data store is accessible. Hashing is a one-way function and does not leave data in a usable state for most purposes that rely on the data being intact and in its original form.