Security Architecture · Topic 5 of 7
Data Types, States and Protection Methods
Security+ data protection: structured and unstructured data, data states, classification labels, and masking, hashing, tokenization and encryption.
- 5 min
- Structured data has fixed fields. Unstructured data, such as documents and email, does not.
- The three data states are at rest, in transit and in use.
- Higher classifications need stricter handling and fewer authorized users.
What it is
Data protection starts with knowing what data you hold, how sensitive it is and where it is in its life. Controls are then matched to the data.
You cannot protect everything equally. Classifying data lets an organization spend the most effort on the data that matters most.
How it works
Data types
| Type | Meaning | Examples |
|---|---|---|
| Structured | Data in a fixed format with defined fields | Database tables, spreadsheets with set columns |
| Unstructured | Data with no fixed format | Documents, email, images, chat messages, recordings |
Structured data is easier to find, label and protect, because a tool knows which field holds what. Unstructured data is harder, because sensitive details can sit anywhere in a file, so discovery tools have to scan the content.
Data states
| State | Meaning | Typical protection |
|---|---|---|
| At rest | Stored on a disk, database or backup | Disk and database encryption, access control |
| In transit | Moving across a network | Transport Layer Security (TLS), virtual private network (VPN) |
| In use | Being processed in memory | Access control, secure enclaves, memory protection |
Data in use is often the hardest state to protect, because it is usually decrypted so that the system can work with it.
Data classifications
Classification labels show how sensitive or important data is. Higher labels get stricter controls and fewer people with access.
| Label | Typical use |
|---|---|
| Top secret | Government: disclosure could cause exceptionally grave damage |
| Secret | Government: disclosure could cause serious damage |
| Confidential | Disclosure could cause damage, so access is limited to those who need it |
| Restricted | Commercial: access tightly limited to named people or roles |
| Sensitive | Data such as personal or internal business information that needs protection |
| Critical | Data the organization cannot operate without, so availability matters as much as secrecy |
| Public | Approved for anyone to see |
Government schemes use top secret, secret and confidential. Commercial schemes vary by organization, but the idea is the same.
Methods used to secure data
| Method | What it does |
|---|---|
| Encryption | Makes data unreadable without a key, and can be reversed with the key |
| Hashing | Creates a one way fingerprint to check integrity or compare values |
| Masking | Hides part of a value, such as showing only the last four digits |
| Tokenization | Replaces the value with a random token, with the real value held in a separate secure store |
| Filtering | Removes or blocks sensitive data so that only what is needed is shown or sent |
| Data transpose | Rearranges the order of characters or values so the stored data is not readable as is |
| Deidentification | Removes or changes the details that link data to a person |
| Obfuscation | Makes data or code harder to read or understand |
Choosing a method
Match the control to the need. If data must be read again by authorized users, encrypt it. If it only needs to be compared, hash it.
If people need to see only part of a value, mask it. If a system must handle a value without storing the real one, tokenize it.
Deidentification suits data used for research or testing. Anonymized data cannot be linked back to the person, while pseudonymized data replaces names with codes that can be linked back by someone holding the extra key.
Transposing and obfuscation only make data harder to read. Anyone who learns the pattern can reverse them, so they do not replace encryption.
How the exam asks about this
- "A support agent may see only the last four digits of a card number." -> Masking.
- "A payment system must process cards without storing the real numbers." -> Tokenization.
- "Patient records are shared with researchers who must not know who the patients are." -> Deidentification.
What to remember for the exam
- Structured data has fixed fields. Unstructured data, such as documents and email, does not.
- The three data states are at rest, in transit and in use.
- Higher classifications need stricter handling and fewer authorized users.
- Top secret, secret and confidential are government labels.
- Critical data is data the organization cannot operate without.
- Encryption can be reversed with a key. Hashing cannot be reversed.
- Masking hides part of a value. Tokenization replaces the value with a token.
- Filtering removes sensitive data from what is shown or sent.
- Deidentification removes the link between data and a person.
- Obfuscation and transposing hide meaning but are not strong protection.
When an answer must keep the real value out of a system entirely, choose tokenization over masking.
Common mistakes
Treating all data the same. Without classification, controls are either too weak for important data or too costly for ordinary data.
Confusing data in use with data at rest. Stored encrypted data is at rest. Data loaded into memory for processing is in use.
Using hashing when data must be recovered. A hash cannot be turned back into the original, so use encryption if the data must be read again.
Thinking masked data is protected in storage. Masking often changes only what is displayed, and the full value may still sit in the database.
Assuming pseudonymized data is anonymous. If someone holds the key that links codes to names, the data can be traced back to people.
Encryption does not help once an authorized account is compromised. Pair it with access control and monitoring.
Check yourself
What are the three states of data?
At rest, in transit and in use.
When would you use tokenization instead of encryption?
When a system needs to handle a stand in value without storing the real data, as with payment card numbers.
What is the difference between structured and unstructured data?
Structured data sits in fixed fields such as database columns, while unstructured data, such as documents and email, has no fixed format.
Topic 5 of 7 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.