Security Architecture · Topic 5 of 6
Data Protection Strategies
Security+ data protection: data types, classification labels, data states, sovereignty, and methods like encryption, masking, tokenization and DLP.
- 4 min
- Data types include regulated, trade secret, intellectual property, legal and financial.
- Higher classifications need stricter handling and fewer authorized users.
- The three data states are at rest, in transit and in use.
What it is
Data protection starts with knowing what data you hold, how sensitive it is and where it lives. Controls are then matched to the data.
You cannot protect everything equally. Classifying data lets an organization spend the most effort on the data that matters most.
How it works
Data types
| Type | Meaning |
|---|---|
| Regulated | Data covered by law or industry rules, such as health or payment card data |
| Trade secret | Business information that gives an advantage because it is secret |
| Intellectual property | Creations such as designs, code and patents |
| Legal information | Contracts, case files and similar records |
| Financial information | Accounts, transactions and payment details |
| Human readable | Data a person can read directly, such as documents |
| Non human readable | Data in a form such as binary or encoded files that needs a tool to interpret |
Classifications
Classification labels show how sensitive data is. Common labels include public, private, sensitive, confidential, restricted and critical. Names differ between organizations, but the idea is the same: higher labels get stricter controls and fewer people with access.
Data states
| State | Meaning | Typical protection |
|---|---|---|
| At rest | Stored on a disk, database or backup | Disk and database encryption, access control |
| In transit | Moving across a network | Transport Layer Security (TLS), virtual private network (VPN) |
| In use | Being processed in memory | Access control, secure enclaves, memory protection |
Data in use is often the hardest state to protect, because it is usually decrypted so that the system can work with it.
Sovereignty and location
Data sovereignty means data is subject to the laws of the country where it is stored. A company that stores customer data in another country may have to follow that country's rules. Geolocation controls and geographic restrictions can limit where data may be stored or accessed.
Methods for securing data
| Method | What it does |
|---|---|
| Encryption | Makes data unreadable without a key |
| Hashing | Creates a one way fingerprint to check integrity |
| Masking | Hides part of a value, such as showing the last four digits |
| Tokenization | Replaces the value with a token, with the real value held in a separate store |
| Obfuscation | Makes data harder to read or understand |
| Segmentation | Keeps sensitive data in separate zones |
| Permission restrictions | Allows only authorized people to read or change data |
| Geographic restrictions | Limits where data may be stored or accessed |
Masking is used when people need to see part of a value, and tokenization is used when systems must handle a value without storing the real one. Encryption suits data that must be recovered later, while hashing suits data that only needs to be compared.
Choosing a method
Match the control to the need.
If data must be read again by authorized users, encrypt it. If it only needs to be checked, hash it. If only a part is needed on screen, mask it.
Data loss prevention
Data loss prevention (DLP) tools watch for sensitive data leaving through email, uploads or removable media, and can block or alert. They depend on correct classification to know what to look for.
What to remember for the exam
- Data types include regulated, trade secret, intellectual property, legal and financial.
- Higher classifications need stricter handling and fewer authorized users.
- The three data states are at rest, in transit and in use.
- Data sovereignty ties data to the laws of the country where it is stored.
- Encryption protects confidentiality and can be reversed with a key. Hashing cannot be reversed.
- Masking hides part of a value. Tokenization replaces the value with a token.
- Segmentation and permission restrictions limit who and what can reach data.
- DLP tools detect and block sensitive data leaving the organization.
For a question asking how to let a support agent see only the end of a card number, the answer is masking. To keep the real number out of the system entirely, it is tokenization.
Common mistakes
Treating all data the same. Without classification, controls are either too weak for important data or too costly for ordinary data.
Confusing data in use with data at rest. Stored encrypted data is at rest. Data loaded into memory for processing is in use.
Using hashing when data must be recovered. A hash cannot be turned back into the original, so use encryption if the data must be recovered.
Ignoring where data is stored. A cloud region in another country can bring different legal duties.
Assuming DLP works without classification. It needs rules or labels that say what is sensitive.
Encryption does not help once an authorized account is compromised. Pair it with access control and monitoring.
Check yourself
What are the three states of data?
At rest, in transit and in use.
What is data sovereignty?
The idea that data is subject to the laws of the country in which it is stored.
When would you use tokenization instead of encryption?
When a system needs to handle a stand in value without storing the real data, as with payment card numbers.
Topic 5 of 6 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.