Security Operations and Incident Response · Topic 1 of 4
Data Security
Data handling with classification, labeling, masking, retention and sanitization, and encryption: symmetric, asymmetric, hashing and quantum-resistant cryptography.
- 3 min
- Classify, label, mask, retain and sanitize data according to policy and law.
- Protect data at rest, in transit and in use.
- Symmetric is fast with one key; asymmetric uses key pairs; hashing checks integrity.
What it is
Data security protects information throughout its life: from creation to use, storage, sharing and destruction. It relies on handling rules (classify, label, protect, keep and dispose) and on encryption to keep data unreadable to anyone without the key.
How it works
Data handling
| Practice | Meaning |
|---|---|
| Classification | Assign a sensitivity level, for example Public, Internal, Confidential, Restricted |
| Labeling | Mark data with its level so people and systems handle it correctly |
| Masking | Hide part of the data, such as showing only the last four digits of a card number |
| Retention | Keep records as long as laws and policy require, then dispose of them |
| Sanitization | Remove data from media so it cannot be recovered before reuse or disposal |
Retention rules come from laws and policy: if a regulation requires seven years, deleting after three breaks the rule; keeping data longer than needed also adds risk. A data retention policy sets these periods, including for logs such as AI assistant conversations that may hold personal data.
Sanitization methods include overwriting (clearing), degaussing magnetic media, cryptographic erasure (destroying the encryption key) and physical destruction (shredding). Simply deleting files or formatting a drive leaves data recoverable.
Never paste confidential or personal data into public AI tools. Data entered into an external AI service may be stored and reused outside the organization's control.
Data states
| State | Protection |
|---|---|
| At rest (stored) | Full-disk or database encryption, access control |
| In transit (moving) | TLS, VPNs |
| In use (being processed) | Access control, memory protection |
A stolen laptop with full-disk encryption keeps its data unreadable to the thief.
Encryption basics
| Type | Keys | Use | Examples |
|---|---|---|---|
| Symmetric | One shared secret key | Fast encryption of large amounts of data | AES |
| Asymmetric | Public and private key pair | Key exchange and digital signatures | RSA, elliptic curve |
| Hashing | No key; one-way | Checking integrity | SHA-256 |
- Comparing a downloaded file's hash with the publisher's hash shows whether it was altered.
- A digital signature uses the sender's private key and lets anyone check it with the public key.
Quantum-resistant cryptography
Large future quantum computers could break today's public-key algorithms such as RSA. Symmetric ciphers such as AES-256 and hash functions are only modestly weakened. Organizations are therefore planning to move to quantum-resistant (post-quantum) algorithms, standardized by bodies such as NIST.
How the exam asks about this
- "Which control keeps a stolen laptop's data unreadable?" Full-disk encryption.
- "How can you tell a downloaded installer was altered?" Compare its hash with the published hash.
- "Which cryptography is most threatened by quantum computers?" Public-key algorithms such as RSA.
What to remember for the exam
- Classify, label, mask, retain and sanitize data according to policy and law.
- Protect data at rest, in transit and in use.
- Symmetric is fast with one key; asymmetric uses key pairs; hashing checks integrity.
- Deleting files does not remove data; sanitize properly.
- Quantum computing threatens public-key algorithms most.
Encryption is only as strong as key protection. A key stored next to the encrypted data protects nothing.
Common mistakes
Thinking hashing is encryption. A hash cannot be reversed to get the data back.
Deleting files instead of sanitizing media.
Keeping data forever.
Check yourself
Which type of encryption uses the same key to encrypt and decrypt?
Symmetric encryption.
What is data masking?
Hiding part of the data, such as all but the last digits of a card number.
What does a retention policy define?
How long records are kept and when they are disposed of.
Topic 1 of 4 in Security Operations and Incident Response
Test yourself on Security Operations and Incident Response
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.