Security Architecture · Topic 6 of 12
Data Protection and Cryptography
Protect data at rest, in transit and in use with encryption, DLP, tokenization, hashing, signatures, PKI, key management and post quantum planning.
- 5 min
- Includes a diagram
- Match controls to data state: at rest, in transit and in use.
- Tokenization and masking reduce how many systems see real data.
- Symmetric encryption is fast for bulk data, asymmetric is used for key exchange and signatures.
What it is
Data centric security protects the data itself, wherever it travels. Controls are chosen by the state of the data: stored, moving, or being processed.
Cryptography supplies the main tools: encryption for confidentiality, hashing for integrity, and digital signatures for origin and integrity together. Architects must also manage the keys, because the strength of encryption depends on how keys are generated, stored and retired.
How it works
Data states and matching controls
| State | Threat | Typical control |
|---|---|---|
| At rest | Stolen media or snapshot | Full disk, file or database encryption such as transparent data encryption |
| In transit | Eavesdropping, tampering | Transport Layer Security (TLS), IP Security (IPsec), secure shell |
| In use | Memory scraping, insider access | Access control, isolation, confidential computing using hardware protected enclaves |
Encryption at rest protects against lost media, but it does not stop an authorized but compromised account from reading data. That is why access control and monitoring still apply.
Reducing exposure of sensitive values
| Technique | How it works | Reversible? |
|---|---|---|
| Encryption | Mathematical transformation using a key | Yes, with the key |
| Tokenization | Replace a value with a random token, mapping kept in a vault | Yes, through the vault |
| Masking | Hide part of a value or substitute fake data | Usually not |
| Hashing | One way digest | No |
Tokenization and masking shrink the number of systems that hold real values, which reduces compliance scope. Data loss prevention (DLP) inspects content on endpoints, networks and cloud services to block or alert on sensitive data leaving.
Symmetric, asymmetric and hashing
Symmetric encryption, such as the Advanced Encryption Standard (AES), uses one shared key and is fast, so it protects bulk data. Asymmetric encryption, such as RSA (named for Rivest, Shamir and Adleman) or elliptic curve cryptography (ECC), uses a key pair, and it handles key exchange and signatures. Real systems combine them: asymmetric methods agree on a key, then symmetric encryption protects the data.
A hash function, such as Secure Hash Algorithm 256 (SHA-256), produces a fixed size digest and is used for integrity. A digital signature is made by signing a hash with the signer's private key, which proves who signed and that the content did not change. For password storage use a slow salted hashing function, not plain fast hashes.
Public key infrastructure
A public key infrastructure (PKI) issues and manages digital certificates. A certificate authority (CA) signs certificates that bind a public key to an identity. Clients trust a certificate if its chain leads to a trusted root.
Revocation tells clients that a certificate must no longer be trusted. A certificate revocation list (CRL) is a published list, and the Online Certificate Status Protocol (OCSP) answers status queries for single certificates. Keep the root CA offline and issue from subordinate CAs, so a compromise of an issuing CA does not expose the root.
Key management
Good practice has several parts.
- Generation and storage in a hardware security module (HSM) or a managed key management service (KMS), so keys never appear in plain form on application servers.
- Separation: keys stored apart from the data they protect.
- Rotation: change keys on a schedule and after suspected exposure.
- Envelope encryption: a data key protects the data, and a master key protects the data key.
- Escrow and recovery: a controlled way to recover keys, balanced against abuse risk.
- Destruction: retire keys securely, which also provides cryptographic erase.
Protocol choices
Use current TLS versions, with 1.3 preferred and old versions disabled. Forward secrecy, provided by ephemeral key exchange, means that stealing a server's long term key later does not reveal past sessions.
Quantum planning
Large quantum computers could break current public key algorithms such as RSA and ECC. An attacker can record encrypted traffic now and decrypt it later ("harvest now, decrypt later"). The National Institute of Standards and Technology (NIST) has standardized post quantum algorithms, so architects should inventory where public key cryptography is used and design for crypto agility, meaning algorithms can be replaced without redesigning the system.
What to remember for the exam
- Match controls to data state: at rest, in transit and in use.
- Tokenization and masking reduce how many systems see real data.
- Symmetric encryption is fast for bulk data, asymmetric is used for key exchange and signatures.
- A digital signature gives integrity, origin and non-repudiation.
- A CA signs certificates, and CRL or OCSP communicate revocation.
- Keep root CAs offline and use subordinate CAs for issuing.
- Store keys in an HSM or KMS, separate from data, and rotate them.
- Plan crypto agility because of the quantum threat to RSA and ECC.
If the stem says the stolen device must be unreadable, the answer is encryption at rest. If it says traffic must resist later key theft, think forward secrecy.
Common mistakes
Encrypting without managing keys. Keys stored next to the data, or hard coded in code, defeat the purpose.
Confusing hashing and encryption. Hashing cannot be reversed. Encryption can be reversed with the key.
Assuming encryption stops insiders. An authorized user or a stolen valid session still sees decrypted data.
Thinking tokenization is encryption. A token has no mathematical relation to the original, and recovery needs the vault.
Losing the only copy of a key means losing the data, so plan secure backup and recovery of keys.
Check yourself
Work through these three questions.
Why combine asymmetric and symmetric encryption?
Asymmetric methods safely agree on a key, and symmetric encryption then protects the bulk data quickly.
What does forward secrecy protect?
Past sessions, because a later theft of the long term key cannot decrypt traffic that used ephemeral keys.
Why keep a root CA offline?
It limits exposure of the most trusted key, so compromise of an online issuing CA does not expose the root.
Topic 6 of 12 in Security Architecture
Test yourself on Security Architecture
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.