Data protection

This objective focuses on data protection, the ultimate goal of information security. Firewalls, access controls, and hardening techniques exist primarily to protect the data itself. To master this for the exam, you need to understand how data is categorized, how its state changes, and which specific methods apply to different scenarios.

1. Data Types

Data inside an enterprise varies by its origin, value, and legal obligations.

• Regulated: Data that is protected by laws, statutes, or industry regulations. Failure to protect it results in heavy fines or legal penalties.
  • Examples: PII (Personally Identifiable Information, such as Social Security numbers), PHI (Protected Health Information under HIPAA), or PCI DSS (Payment Card Industry data for credit cards).
• Trade Secret: Proprietary formulas, practices, processes, designs, or compilations of information used by a business to obtain an economic advantage over competitors. (e.g., The Coca-Cola syrup formula).
• Intellectual Property (IP): Creations of the mind that are legally protected via patents, copyrights, or trademarks. (e.g., the proprietary source code of a software application or a unique hardware design blueprint).
• Legal Information: Highly confidential data regarding corporate legal matters, pending lawsuits, regulatory audits, or contract negotiations.
• Financial Information: Data detailing the organization’s economic health, including bank account records, quarterly tax filings, payroll summaries, and pre-public earnings reports.
• Human-Readable vs. Non-Human-Readable:
  • Human-Readable: Data that can be easily and naturally read and understood by a person without modification (e.g., plain-text CSV files, Word documents, PDF invoices).
  • Non-Human-Readable: Binary data, compiled code, machine logs, or heavily encrypted blobs that require specialized software or decryption keys to interpret.

2. Data Classifications

Organizations assign classification labels to data to determine the level of security controls and access restrictions it requires.

Exam Note: Government/Military classification labels (Top Secret, Secret, Confidential, Unclassified) differ from Private Sector commercial labels. CompTIA expects you to recognize common commercial tiers:

• Public: The lowest classification level. Data that is safe for the general public to view and has zero negative impact if disclosed. (e.g., Marketing brochures, public website content, press releases).
• Private: Data intended for internal use within the organization, often related to daily operations or internal personnel. (e.g., Internal phone directories, company-wide memos).
• Sensitive: Data that requires special protection because unauthorized disclosure could cause noticeable harm, financial loss, or reputational damage to the organization. (e.g., Customer email lists, standard operational metrics).
• Confidential: Highly restricted data that could cause severe or catastrophic damage to the organization or its clients if leaked. Access is restricted to specific individuals on a strict need-to-know basis. (e.g., Mergers and acquisitions plans, trade secrets, executive emails).
• Restricted / Critical: Custom labels are often used for data essential to the survival of the business, or for data bound by strict compliance requirements that can only be accessed from specific secure terminals.

3. General Data Considerations

Data changes its security profile depending on what it is doing and where it physically resides.

The Three Data States

Security controls must be tailored to the specific state the data is currently in:

• Data at Rest: Data that is physically stored on persistent media and is not actively being moved or processed.
  • Examples: A database file on a SAN storage array, an archived backup tape, or files on a local laptop NVMe drive.
  • Primary Defense: Full-disk encryption (FDE) and physical access controls.
• Data in Transit (In Motion): Data actively moving across a network link from one location to another.
  • Examples: Sending an email, browsing an HTTPS website, or replicating database blocks across a WAN link.
  • Primary Defense: Transport-level encryption protocols such as TLS, HTTPS, or IPsec VPNs.
• Data in Use: Data currently loaded into active system memory (RAM, CPU cache, or CPU registers) and being processed by an application.
  • Examples: An open Excel spreadsheet you are editing or an active application that decrypts a password in RAM to authenticate a user.
  • Primary Defense: Secure Enclaves, process memory isolation, and immediate buffer clearing after execution. (Note: Traditional mathematical encryption cannot protect data while it is being actively processed by standard CPUs).

Data Sovereignty & Geolocation

• Data Sovereignty: The legal principle that digital data is subject to the laws and regulations of the country in which it is physically located.
  • Security Implication: If a US company stores European customer data on a physical cloud server located in Germany, that data is legally subject to European privacy laws (like GDPR), not US laws.
• Geolocation: The exact physical location of a device or data center (determined by GPS coordinates, IP addresses, or cellular signals). Organizations track geolocation to ensure compliance and detect malicious access from unexpected countries.

4. Methods to Secure Data

To protect data across its various states and types, security teams implement a matrix of technical controls:

• Geographic Restrictions (Geofencing): Restricting data access based on the user’s physical location.
  • Example: Configuring a cloud platform to block user login attempts originating outside the United States or from sanctioned nations, regardless of whether the attempts have valid credentials.
• Encryption: Transforming readable plaintext into unreadable ciphertext using a mathematical algorithm and a cryptographic key. (The absolute gold standard for protecting Data at Rest and Data in Transit).
• Hashing: Running data through a one-way mathematical function to verify its Integrity. If a single bit of the underlying data changes, the resulting hash code changes completely.
• Masking: Hiding specific characters of data to protect privacy while maintaining structural consistency. (e.g., changing a customer’s Social Security Number display to XXX-XX-1234 on a customer service terminal).
• Tokenization: Completely replacing sensitive data with a non-sensitive substitute token. The actual data is mapped and stored inside a separate, highly secured data vault. (Commonly used to secure credit card details during financial transactions).
• Obfuscation: Making data or program code difficult for an unauthorized person or machine to understand, without altering its underlying operational capability.
• Segmentation: Isolating data stores into separate, secure network zones or database schemas so that a breach in one department (e.g., Marketing) does not give an attacker lateral access to critical data stores elsewhere (e.g., Finance).
• Permission Restrictions: Apply strict Access Control Lists (ACLs) and role-based access control (RBAC) to folders and databases, ensuring that only users with a valid business “need-to-know” can view or modify the data.