Compare and contrast concepts and strategies to protect data
Data classification, states, sovereignty, and methods: encryption, hashing, masking, tokenization, obfuscation.
- Reading time
- 22 min read
- Flashcards
- 14 cards
- Practice questions
- 8 questions · 2 PBQs
This objective is about the data itself: what kind it is, how sensitive, where it lives, and how to protect it in each state. Much of the protection toolkit already appeared in 1.4 — here you are matching tools to data rather than learning them fresh.
Data states
Three, and the exam tests which protection applies to each.
At rest
- Stored on disk or media
- Protect with: full-disk, file or database encryption
In transit
- Moving across a network
- Protect with: TLS, IPSec, VPN
In use
- Loaded in memory, being processed
- Hardest to protect — secure enclaves, memory encryption
The tellIn use is the hard one. Data must be decrypted to be processed, which is why full-disk encryption does nothing against malware on a running machine.
Check yourself
A finance application must protect customer records while they are being processed in server memory. Which state is this, and what protects it?
Data classification
Levels vary by organisation, but CompTIA names: public, private, sensitive, confidential, restricted, critical.
Classification drives everything downstream — how strictly data is controlled, who may see it, how long it is retained, and how it must be destroyed (4.2).
Data types
- Regulated — subject to law: health records, payment data
- Trade secret — commercially valuable because it is secret
- Intellectual property — patents, designs, creative work
- Legal information — privileged or litigation-related
- Financial information — accounts, transactions
- Human-readable vs non-human-readable — plain text versus binary or encoded formats
Sovereignty and geolocation
Data sovereignty
Data is subject to the laws of the country it physically resides in. This is why some jurisdictions require citizen data to stay within their borders, and why a multinational can face conflicting obligations (5.4).
Geolocation and geographic restrictions control where data may be stored or accessed from — a cloud region setting, or blocking access from countries where you have no staff.
Methods to secure data
Most of these appeared in 1.4. The exam tests choosing between them:
Encryption
- Reversible with the key
- Use when the original must be recovered
Hashing
- One-way, irreversible
- Use to verify, never to recover
Tokenization
- Replaces value with unrelated token
- Real data in a separate vault; reduces PCI scope
Masking
- Hides part of the value for display
- Original still present underneath
The tellMust you get the original back? Encryption or tokenization. Only verifying? Hashing. Only hiding it on screen? Masking.
Obfuscation makes data harder to interpret but is not a security control on its own. Segmentation separates sensitive data from everything else. Permission restrictions limit who may reach it — least privilege again.
Geographic restrictions are worth noting as a data control rather than a network one here: restricting which regions data may be stored in or accessed from.
Check yourself
A support system must display the last four digits of a card number so agents can confirm identity, while the full number stays protected. Which method fits?
Choosing a method
Work from the requirement:
| Requirement | Method |
|---|---|
| Recover the original later | Encryption |
| Prove it has not changed | Hashing |
| Remove sensitive data from a system entirely | Tokenization |
| Show part of it on screen | Masking |
| Keep it away from other systems | Segmentation |
| Limit who can reach it | Permission restrictions |
| Control where it physically lives | Geographic restrictions |