Application and Data Protection · Topic 4 of 4
Data Masking, Backup, Destruction and DLP
Learn data masking and tokenization, backup types and the 3-2-1 rule, retention, secure data destruction per NIST SP 800-88, and DLP concepts.
- 5 min
- Full, incremental, differential: incremental restores slowest, differential needs full plus latest differential.
- 3-2-1: three copies, two media types, one offsite.
- NIST 800-88 levels: clear, purge, destroy.
What it is
The last part of the data life cycle covers how data is hidden when used for other purposes, how it is saved and restored, how it is destroyed when no longer needed, and how it is stopped from leaving by mistake or theft.
How it works
Data masking concepts
Data masking replaces sensitive values with realistic but fake ones so the data can be used for testing, development, training or analytics without exposing the real data.
| Technique | What it does |
|---|---|
| Substitution | Replaces values with other realistic values |
| Shuffling | Rearranges real values among records |
| Nulling out | Replaces values with blanks or nulls |
| Number or date variance | Alters numbers or dates by a random amount |
| Character masking | Hides part of a value, such as showing only the last four digits |
| Tokenization | Swaps the value for a random token. The mapping is kept in a protected vault. |
| Encryption | Reversible with the key, so it is protection, not masking in the strict sense |
Static masking creates a permanently masked copy for non production use. Dynamic masking hides values on the fly at query time based on who is asking. Masking should preserve the format so applications still work, and the process must not allow the original data to be rebuilt easily.
Data backup and retention
| Backup type | Copies | Restore needs |
|---|---|---|
| Full | Everything | Just that backup |
| Incremental | Changes since the last backup of any type | Last full plus every incremental |
| Differential | Changes since the last full backup | Last full plus latest differential |
Incremental is fastest to back up and slowest to restore. Differential is a middle ground.
- 3-2-1 rule: three copies, on two different media, one stored offsite. A common extension adds one offline or immutable copy against ransomware.
- RPO (recovery point objective): how much data loss is tolerable, which sets backup frequency.
- RTO (recovery time objective): how long recovery may take.
- Encrypt backups, restrict access and test restores regularly, because an untested backup is only a hope.
- RAID provides availability when a disk fails. It is not a backup because deletion and ransomware affect all copies.
Retention defines how long data is kept, based on business need and law (for example financial or health records). Keep data as long as required and no longer, because old data is a liability. A retention schedule also states when to delete, and legal hold suspends deletion during litigation.
Data destruction concepts
Deleting a file or formatting a disk does not remove the data. Secure disposal follows NIST SP 800-88 media sanitization levels.
| Level | Meaning | Examples |
|---|---|---|
| Clear | Overwrite so ordinary recovery fails | Overwriting with fixed patterns, factory reset |
| Purge | Make recovery infeasible even with lab techniques | Cryptographic erase, secure erase commands, degaussing for magnetic media |
| Destroy | Physically ruin the media | Shredding, disintegration, incineration |
Notes: degaussing works on magnetic media (hard disks, tapes) and not on SSDs. Cryptographic erase destroys the encryption key so the data is unreadable, and it suits encrypted SSDs and cloud storage. Paper is cross cut shredded. Keep a certificate of destruction and a chain of custody, and destroy data on every copy, including backups.
Data loss prevention (DLP) concepts
DLP finds and protects sensitive data and blocks it from leaving through unauthorized channels.
| DLP type | Where it works |
|---|---|
| Network DLP | Watches data in motion at email, web and file transfer gateways |
| Endpoint DLP | Watches data in use on devices: copy to USB, print, screen capture, upload |
| Storage / discovery DLP | Scans data at rest on servers and cloud storage to find sensitive data |
| Cloud DLP | Applies to SaaS and cloud storage |
Detection methods include content inspection of patterns (regular expressions for card or ID numbers), keywords, data fingerprinting of known documents, exact data matching, and classification labels. Actions are to log, alert, block, quarantine, encrypt or ask the user to justify. A normal rollout starts in monitor mode to tune out false positives.
A worked example
A retailer copies its customer database to a test system with names replaced and card numbers tokenized. Nightly full and incremental backups are encrypted, one copy goes offsite and one is immutable. Retired laptops get a cryptographic erase and the drives are shredded at end of life. Endpoint DLP blocks an employee from copying a file with card numbers to a USB drive.
How the exam asks about this
- "Which backup type copies only changes since the last full backup?" → Differential.
- "Which technique replaces a value with a random placeholder stored in a vault?" → Tokenization.
- "Which NIST publication guides media sanitization?" → NIST SP 800-88.
What to remember for the exam
- Full, incremental, differential: incremental restores slowest, differential needs full plus latest differential.
- 3-2-1: three copies, two media types, one offsite.
- NIST 800-88 levels: clear, purge, destroy.
- Degaussing does not work on SSDs. Cryptographic erase does.
- DLP covers data in motion (network), in use (endpoint) and at rest (storage).
RAID, replication and a file delete are not backups. They copy deletions and corruption, which a true backup lets you roll back from.
Common mistakes
Calling masking encryption. Masking hides values, usually irreversibly, while encryption is reversible with a key.
Never testing restores. Backups fail silently, so scheduled restore tests are part of the process.
Forgetting the backups when destroying data. Old copies keep the data alive.
Check yourself
What is the 3-2-1 backup rule?
Three copies of the data, on two different media, with one copy offsite.
Why is a quick format not secure disposal?
It leaves the data recoverable, so media must be cleared, purged or destroyed according to NIST SP 800-88.
What does endpoint DLP add that network DLP does not?
It controls data in use on the device, such as copying to USB, printing or uploading, even when the device is off the corporate network.
Topic 4 of 4 in Application and Data Protection
Test yourself on Application and Data Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.