Application and Data Protection · Topic 2 of 4
Data Security, Integrity, Access Control and Encryption at Rest
Learn why data security matters, how hashes and signatures keep integrity, how DAC, MAC and RBAC control access, and how to encrypt data at rest.
- 4 min
- CIA: confidentiality, integrity, availability.
- Hash proves integrity, HMAC adds a key, a digital signature adds origin and non repudiation.
- DAC (owner), MAC (labels), RBAC (roles), ABAC (attributes).
What it is
Data is the thing attackers want and regulations protect. Data security keeps data confidential, intact and available through its whole life. This page covers the goals, integrity, access control and encryption of stored data.
How it works
Data security and its importance
The CIA triad defines the goals.
| Goal | Meaning | Example control |
|---|---|---|
| Confidentiality | Only authorized people can read it | Encryption, access control |
| Integrity | Data is accurate and unaltered | Hashing, signatures, change control |
| Availability | Data is usable when needed | Backup, redundancy |
Data may be at rest (stored), in transit (moving) or in use (being processed). Breaches cause financial loss, legal penalties under laws such as GDPR, HIPAA and PCI DSS, and loss of trust. A first step is data classification (for example public, internal, confidential, restricted), because controls should match sensitivity.
Data integrity
Integrity means data has not been changed in an unauthorized way, accidentally or on purpose.
| Mechanism | How it protects integrity |
|---|---|
| Hash (SHA-256) | A fixed length fingerprint. If the data changes, the hash changes. |
| HMAC | A hash combined with a secret key, so it also proves who made it |
| Digital signature | A hash encrypted with the sender's private key. Proves integrity, origin and non repudiation. |
| Checksums and error detection | Catch accidental corruption |
| File integrity monitoring | Alerts when critical files change |
| Database constraints and transactions | Keep records consistent |
| Version control, audit logs and change management | Show who changed what |
| Backups | Restore a known good copy |
MD5 and SHA-1 are considered weak for security use, so SHA-256 or stronger is the modern answer.
Implementation of data access controls
| Model | Who decides | Notes |
|---|---|---|
| DAC (discretionary) | The data owner | Flexible, for example file permissions set by the owner |
| MAC (mandatory) | The system, using labels and clearances | Strict, used in high security environments |
| RBAC (role based) | Permissions assigned to roles | Most common in business |
| ABAC (attribute based) | Policy using user, resource and context attributes | Fine grained and dynamic |
Principles: least privilege, need to know, separation of duties and regular access reviews. Combine authentication (ideally with MFA), authorization and accounting (logging). Database controls include views, row level restrictions and separate accounts per application.
Encryption of data at rest
Encryption of stored data makes it useless if a drive, backup or database file is stolen.
| Level | Examples |
|---|---|
| Full disk or volume | BitLocker, LUKS, FileVault, self encrypting drives |
| File or folder | EFS, encrypted archives, application level encryption |
| Database | Transparent data encryption (TDE) and column level encryption |
| Cloud storage | Server side encryption with provider or customer managed keys |
| Backups and removable media | Encrypt tapes, USB drives and cloud backup |
The usual algorithm is AES (128, 192 or 256 bit keys), a symmetric cipher. Key management is critical: store keys apart from the data (in a hardware security module or key management service), rotate them, limit who can use them and back them up securely. Losing the key means losing the data.
A worked example
A hospital classifies patient records as restricted. A role based model lets nurses read records on their ward only, while an audit log tracks every access. The database uses TDE, backups are encrypted with AES-256 and the keys are held in an HSM. File integrity monitoring watches the application configuration.
How the exam asks about this
- "Which security goal does hashing primarily support?" → Integrity.
- "Which access control model lets the data owner decide who gets access?" → Discretionary access control (DAC).
- "Which feature encrypts a database's files on disk?" → Transparent data encryption (TDE).
What to remember for the exam
- CIA: confidentiality, integrity, availability.
- Hash proves integrity, HMAC adds a key, a digital signature adds origin and non repudiation.
- DAC (owner), MAC (labels), RBAC (roles), ABAC (attributes).
- AES is the standard for data at rest, and key management decides how secure it really is.
- Encryption at rest does not protect data in use or from an authorized, logged in user.
Storing the encryption key next to the encrypted data defeats the purpose. Keys belong in separate, protected storage.
Common mistakes
Calling a hash encryption. A hash is one way. It checks integrity but cannot be reversed.
Granting access to individuals instead of roles. It does not scale and is hard to review.
Believing encrypted means integrity protected. Encryption alone does not prove data was not modified. Add a hash, MAC or signature.
Check yourself
Which model assigns permissions to job roles?
Role based access control (RBAC).
What does a digital signature provide beyond a plain hash?
Proof of the sender's identity and non repudiation, because it uses the sender's private key.
Why is key management important for encryption at rest?
The data is only as safe as the keys, and a lost key makes the data unrecoverable.
Topic 2 of 4 in Application and Data Protection
Test yourself on Application and Data Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.