Data Protection & Cryptography
95 cards · 4 sections
Sections▾
Data Protection (OBJ 1.4, 3.3, 4.2, 4.4, & 5.1)
Data Protection
The process of safeguarding important information from corruption, compromise, or loss.
Data at Rest
Data stored on a disk, solid-state drive, backup media, or other storage location when it is not actively moving across a network.
Data in Transit
Data moving between systems or networks. It is commonly protected with encrypted communications and tunneling.
Data in Use
Data actively being processed, accessed, or held in system memory by an application or user.
Regulated Data
Data that must be handled according to specific legal, regulatory, or compliance requirements.
Trade Secret
Proprietary business information that provides a competitive advantage and loses value if disclosed.
Intellectual Property (IP)
Creations of the mind owned by an individual or organization, such as source code, designs, or other proprietary content.
Data Sovereignty
The principle that data is subject to the laws and governance structures of the nation where it is collected, stored, or processed.
Data Loss Prevention (DLP)
A strategy and toolset used to detect and prevent sensitive or critical information from leaving an organization, either intentionally or unintentionally.
Why data protection matters
data protection as a core information security function in an increasingly digital world.
- Protects confidentiality, integrity, and availability of data
- Reduces risk of corruption, compromise, and loss
- Matters to individuals, businesses, and governments alike
5 exam objectives tied to this section
Data protection maps to multiple Security+ objectives:
- 1.4: appropriate cryptographic solutions
- 3.3: concepts and strategies to protect data
- 4.2: hardware, software, and data asset management implications
- 4.4: security alerting and monitoring concepts and tools
- 5.1: elements of effective security governance
Major topic sequence in the section
the main areas you need to understand for data protection:
- Data classifications
- Data ownership roles
- Data states
- Data types
- Data sovereignty
- Data security methods
- Data Loss Prevention (DLP)
Data states and their primary protection focus
three data states and ties controls to each state.
- Data at rest: protect stored data with controls such as disk encryption
- Data in transit: protect moving data with encrypted communications or tunneling
- Data in use: protect actively processed data through access control and secure handling
Data types
The section also previews several categories of information that often require different handling rules.
- Regulated data
- Trade secrets and intellectual property
- Legal and financial information
- Human-readable and non-human-readable data
Core protection methods
several methods used to secure data across environments and states:
- Geographic restrictions
- Encryption and hashing
- Masking and tokenization
- Obfuscation, segmentation, and permission restrictions
- Disk encryption and communication tunneling for different data states
Key governance and ownership themes
The section ties technical protection to ownership, legal jurisdiction, and governance responsibilities.
- Ownership roles include owner, controller, processor, custodian, and steward
- Data sovereignty determines which national laws apply
- DLP supports organizational control over sensitive information movement
Question asks which country’s laws govern stored or collected data -> Data sovereignty
If the scenario focuses on legal jurisdiction over how data is stored, processed, or managed, identify data sovereignty.
Question focuses on legal or compliance handling requirements -> Regulated data
If the scenario emphasizes mandatory protection because of laws, regulations, or compliance rules, identify the information as regulated data.
Sensitive data must not leave the organization unintentionally -> Data Loss Prevention (DLP)
If the scenario centers on preventing exfiltration or accidental sharing of sensitive data, identify DLP as the primary strategy.
Question asks how to protect data in different states -> Match control to data state
Expect the exam to pair controls like disk encryption or communication tunneling with data at rest, in transit, or in use.
Data protection is cross-domain, not only cryptography
If the answer choices span governance, monitoring, asset management, and technical controls, remember this section maps across Domains 1, 3, 4, and 5.
Data Classifications (OBJ 3.3, 4.2, & 5.1)
Data Classification
The process of categorizing data based on its value to the organization and the sensitivity of the information if it is disclosed.
Data Owner
The person responsible for deciding the classification level assigned to organizational data based on its value to the organization and its sensitivity if disclosed.
Sensitive Data
Information that can result in loss of security or loss of competitive advantage if accessed by unauthorized persons.
Public Data
Commercial data that would have little or no impact on the organization if released publicly.
Private Data
Internal data relating to individuals or internal organizational operations that should not be publicly shared.
Confidential Data (Commercial)
Business data such as trade secrets, intellectual property, or source code that would seriously affect the organization if disclosed.
Critical Data
Information considered too valuable to allow significant risk if it is captured or exposed, so access is severely restricted.
Unclassified Data
Government data that can generally be released to the public, including through Freedom of Information Act processes.
Sensitive but Unclassified Data
Government data such as medical or personal records that may affect individuals if exposed but would not damage national security.
Confidential Data (Government)
Government information that could seriously affect operations or interests if disclosed without authorization.
Secret Data
Government information such as deployment plans that could seriously damage national security if disclosed.
Top Secret Data
Government information whose unauthorized disclosure would gravely damage national security.
Why classification matters
that not all data can or should receive the same level of protection.
- Higher classifications require more protections and resources
- Lower classifications require fewer controls
- The data owner decides the proper classification level
Commercial classification levels
these common business classifications from lowest to highest:
- Public: information that causes little or no harm if released
- Sensitive: information that causes limited impact or loss of advantage if disclosed
- Private: internal or individual-related information meant for internal organizational use
- Confidential: trade secrets, source code, intellectual property, or similar data that would seriously affect the business if exposed
- Critical: extremely valuable data with severely restricted access because compromise creates severe impact
Government classification levels
these government or military classifications from lowest to highest:
- Unclassified: releasable to the public with little or no national security impact
- Sensitive but unclassified: information that affects individuals or operations but not national security
- Confidential: government data whose unauthorized disclosure could seriously affect the government
- Secret: information whose disclosure could seriously damage national security
- Top secret: information whose disclosure would gravely damage national security
Overclassification creates avoidable cost
Classifying too much data at a high level wastes organizational resources.
- Increases spending on personnel and controls
- Forces broader deployment of access restrictions and technical protections
- Should be avoided by using clear classification policies
Classification affects data lifecycle decisions
classification to storage, retention, and destruction policies.
- Policies should define how data is stored
- Policies should define how long data is retained
- Policies should define how data is destroyed when no longer needed
- Retention must also follow applicable laws and regulations
Commercial and government labels are not interchangeable
two different classification schemes, so answer choices must be matched to the organization type in the scenario.
- Commercial examples: public, sensitive, private, confidential, critical
- Government examples: unclassified, sensitive but unclassified, confidential, secret, top secret
- Use business-impact language for commercial data and national-security language for government data
Question asks who assigns the classification level -> Data owner
If the scenario focuses on who determines how sensitive or valuable data is to the organization, identify the data owner.
Trade secrets, source code, or intellectual property -> Confidential data
If disclosure would seriously affect the business and access is limited to approved personnel or NDA-bound third parties, identify confidential data.
Question uses commercial labels vs government labels -> Match the scheme first
Public is a commercial label, while unclassified is a government label. Do not swap them unless the scenario explicitly mixes both contexts.
Medical or personal files that affect individuals but not national security -> Sensitive but unclassified
If the scenario is government-oriented and the exposure harms individuals or operations without rising to national-security damage, identify sensitive but unclassified data.
Government data whose disclosure would seriously damage national security -> Secret
If disclosure would seriously damage national security, classify it as secret.
Government data whose disclosure would gravely damage national security -> Top secret
If the scenario describes the highest-impact government data with grave national security consequences, identify top secret.
Question compares private, confidential, and critical -> choose based on business impact
Private data is internal or individual-related, confidential data would seriously affect the business if exposed, and critical data is too valuable to tolerate meaningful disclosure risk.
Data Ownership (OBJ 3.3, 4.2, & 5.1)
Data Ownership
The process of identifying the person responsible for the confidentiality, integrity, availability, and privacy of information assets.
Data Owner
A senior executive with ultimate responsibility for the confidentiality, integrity, and availability of an information asset. The data owner is responsible for labeling the asset and ensuring it is protected with the appropriate controls.
Data Controller
The entity responsible for deciding the purposes and methods of data storage, collection, and usage, and for guaranteeing the legality of those processes. The data controller holds ultimate accountability for privacy breaches and cannot delegate that responsibility.
Data Processor
An entity that processes data on behalf of the data controller. The data processor is a group or individual hired by the controller to collect, store, or analyze data under the controller's direction and instructions.
Data Steward
The role focused on the quality of the data and the associated metadata. The data steward works for the data owner and helps ensure the data is appropriately labeled and classified.
Data Custodian
The role responsible for handling the management of the systems on which data assets are stored. The data custodian enforces access controls, encryption, and backup and recovery measures based on the requirements set by the data owner.
Data Privacy Officer
The role responsible for oversight of privacy-related data such as Personally Identifiable Information (PII), Sensitive Personal Information (SPI), and Protected Health Information (PHI). The data privacy officer helps ensure compliance with legal and regulatory frameworks, consent, purpose limitation, data minimization, data sovereignty, and data retention requirements.
6 roles
data ownership into these enterprise roles:
- Data owner: senior business leader with ultimate responsibility for the asset
- Data controller: decides the purposes and methods of data storage, collection, and usage
- Data processor: group or individual hired by the controller to collect, store, or analyze data under the controller's direction
- Data steward: maintains data quality, metadata, labeling, and classification accuracy
- Data custodian: manages the systems and technical protections for stored data based on owner requirements
- Data privacy officer: oversees privacy-related data and regulatory compliance
What the data owner actually does
that the data owner is not the file creator, but the business-side authority over the information asset.
- Labels the asset and determines its classification
- Specifies which protections should apply to that type of information
- Holds ultimate responsibility for the asset's confidentiality, integrity, and availability
Controller, processor, steward, and custodian distinctions
These roles differ by business decision-making, delegated processing, quality oversight, and technical administration.
- Controller: decides the purpose, methods, and lawful handling of data and remains accountable for privacy compliance
- Processor: is hired by the controller and processes data under the controller's instructions
- Steward: ensures data quality, metadata, labeling, and classification are correct
- Custodian: enforces access control, encryption, backup, and recovery protections on the systems
Data privacy officer focus areas
The privacy officer role centers on lawful and privacy-conscious treatment of sensitive personal information.
- Oversees privacy-related data such as Personally Identifiable Information (PII), Sensitive Personal Information (SPI), and Protected Health Information (PHI)
- Ensures compliance with legal and regulatory privacy frameworks
- Focuses on consent, purpose limitation, data minimization, data sovereignty, and data retention
Why IT should usually be the custodian, not the owner
IT understands the systems, while business units understand the meaning and sensitivity of the data.
- IT personnel usually manage the infrastructure and technical controls
- Business-side leaders understand the context needed for proper classification
- The best data owner is the person who knows the data well enough to classify and protect it correctly
Creating a file does not make someone the data owner
authorship from ownership in an enterprise environment.
- A file creator may be a user or contributor, not the business authority over the data
- The data owner is the business-side role that classifies the information and defines required protections
- Technical staff usually implement controls as custodians rather than own the data
Question asks who has ultimate responsibility for an information asset -> Data owner
If the scenario focuses on who labels the data, determines required controls, and holds overall responsibility, identify the data owner.
Question says someone created the file -> Not automatically the data owner
If the exam contrasts the person who made or stored the file against the person responsible for classification and protection, choose the business-side data owner instead of the file creator.
Question asks who decides why and how data is processed -> Data controller
If the role sets the purpose and methods of collection, storage, and usage, identify the data controller.
Third party handles data under another entity's instructions -> Data processor
If a group is hired to collect, store, or analyze data on behalf of the controller, identify it as the data processor.
Controller vs processor -> Accountability stays with the controller
If one party decides the purpose and methods while another party performs the work, the controller remains accountable and the processor acts under the controller's instructions.
Question asks who maintains labeling quality, metadata, and classification accuracy -> Data steward
If the role focuses on data quality and making sure labeling or classification is applied correctly, identify the data steward.
Question asks who oversees privacy compliance for PII, SPI, or PHI -> Data privacy officer
If the scenario centers on privacy-related data, consent, data minimization, sovereignty, retention, or regulatory compliance, identify the data privacy officer.
System administrator enforces backups, encryption, and access controls -> Data custodian
If the scenario centers on technical administration of the systems holding the data, identify the data custodian.
IT department wants to be the data owner -> Usually incorrect
If the exam contrasts business knowledge against technical administration, remember IT is usually the custodian while the business-side leader should be the data owner.
Data States (OBJ 3.3)
Data at Rest
Data stored in databases, file systems, or other storage systems that is not actively moving across a network or being processed.
Data in Transit
Data actively moving from one location to another across the Internet or a private network. Also called data in motion.
Data in Use
Data currently being created, retrieved, updated, deleted, or otherwise processed by a system.
Access Control List (ACL)
A list of permissions that determines which users or processes can access an object and what actions they are allowed to perform.
Full Disk Encryption (FDE)
Encryption that protects the entire hard drive. When the system is powered off, the data remains encrypted until the device is unlocked.
Partition Encryption
Encryption applied only to selected disk partitions, leaving other partitions unencrypted.
File Encryption
Encryption applied to individual files when only specific files require protection.
Volume Encryption
Encryption applied to a logical volume, folder set, or selected group of files and directories.
Database Encryption
Encryption applied to data stored in a database, often at the column, row, or table level.
Record Encryption
Encryption applied to specific fields within a database record so only authorized users can view those values.
Secure Sockets Layer (SSL)
An older protocol family for encrypted network communication. On modern systems, Transport Layer Security (TLS) is the preferred replacement.
Transport Layer Security (TLS)
A cryptographic protocol used to provide secure communication over computer networks for web browsing, email, and other data transfers.
Virtual Private Network (VPN)
A technology that creates an encrypted connection across an untrusted network such as the Internet.
Internet Protocol Security (IPSec)
A protocol suite that authenticates and encrypts IP packets to secure Internet Protocol communications.
Secure Enclave
An isolated processing environment used to handle sensitive data in use while protecting it from untrusted processes.
Application-level Encryption
Encryption implemented by the application to protect sensitive data during processing or before it is written to storage or sent across a network.
Three data states and their primary protections
Each data state maps to a different exposure point and a different control emphasis.
- Data at rest: use encryption and Access Control Lists (ACLs) to protect stored data
- Data in transit: use communication encryption or tunneling protocols to protect moving data
- Data in use: use access controls, application-level protections, and isolated processing environments
Data at rest can be encrypted at multiple layers
several ways to protect stored data depending on how much of the storage target must be encrypted.
- Full disk encryption: encrypt the entire drive
- Partition encryption: encrypt only a selected partition
- File encryption: encrypt a single file
- Volume encryption: encrypt a selected set of files or directories
- Database encryption: encrypt stored database content at the column, row, or table level
- Record encryption: encrypt specific fields inside a database record
Data in transit requires protected communications
Moving data is vulnerable to interception, so the lesson maps transport protection to encrypted communication protocols.
- SSL/TLS: secure communication for web browsing, email, and other transfers
- VPN: creates an encrypted connection across a less secure network
- IPSec: authenticates and encrypts each IP packet in a data stream
Data in use is harder to secure than stored data
Data in use must often be decrypted for processing, which creates exposure while the application or system is working on it.
- Apply access controls so only authorized users or processes can work with the data
- Use application-level encryption where the workflow supports it
- Use secure enclaves or protected memory technologies to isolate sensitive processing
Do not confuse where the risk exists
The main exam distinction is whether the data is stored, moving, or actively processed when the exposure occurs.
- Stored in a drive, file system, or database: data at rest
- Moving between systems or across a network: data in transit
- Open in memory or being processed by an application: data in use
Stored on a drive, server, or database -> Data at rest
If the scenario focuses on information sitting in storage, identify data at rest and choose controls such as encryption or ACLs.
Moving across the Internet or a private network -> Data in transit
If the scenario centers on interception while data is being transmitted, identify data in transit and choose TLS, a VPN, or IPSec.
Question uses 'data in motion' -> Data in transit
If the exam uses the phrase data in motion, treat it as the same state as data in transit.
Actively processed in memory or by an application -> Data in use
If the scenario focuses on data being created, read, updated, or deleted right now, identify data in use and choose access controls, secure enclaves, or application-level encryption.
Question asks what scope is encrypted -> Match the encryption layer
Entire drive -> full disk encryption. One partition -> partition encryption. One file -> file encryption. Selected folders or file set -> volume encryption. Database contents -> database or record encryption.
SSL vs TLS in answer choices -> Prefer TLS unless the question uses the legacy name
If the exam asks for the modern protocol used to secure network communication, choose TLS. SSL may appear as legacy wording or in older terminology.