Protecting data

Data protection starts with knowing what data you have and how sensitive it is. This objective covers data types and classifications, the three data states, data sovereignty, and the methods used to protect data: encryption, hashing, masking, tokenization, obfuscation, segmentation, and permission restrictions.

Types and classifications

Data types include regulated data (health, payment, personal), trade secrets, intellectual property, legal and financial information, and human- versus non-human-readable data. A classification scheme labels data by sensitivity so handling rules follow the label.

Data states and location

Data sovereignty means data is subject to the laws of the country where it's stored. Geolocation and geographic restrictions keep data in approved regions, which matters for laws such as GDPR.

Protection methods

• Encryption: unreadable without the key.
• Hashing: one-way digest for integrity checks.
• Masking: hide part of a value on screens or in test data.
• Tokenization: replace the value with a random token held in a vault.
• Obfuscation: make data or code hard to understand.
• Segmentation: store sensitive data in its own protected zone.
• Permission restrictions: limit who can read or change it.

Key terms

Data at rest

Data stored on disks, databases, or backups rather than moving or being processed.

Data in transit

Data moving across a network between systems.

Data in use

Data loaded in memory and being actively processed.

Data sovereignty

The principle that data is subject to the laws of the country where it is stored.

Regulated data

Information whose handling is governed by laws or industry rules, such as health or payment data.

Intellectual property

Creations of the mind, such as designs, code, and inventions, that an organization owns.

Confidential classification

A label for data whose disclosure would cause serious harm and must be tightly limited.

Public classification

A label for information approved for release to anyone.

Data masking

Hiding part of a sensitive value, such as showing only the last four digits.

Geographic restrictions

Controls that limit where data can be stored or accessed from by location.

Obfuscation

Making data or code difficult to understand without changing what it does.

Permission restrictions

Limiting who can read, change, or delete data based on need.

Trade secret

Confidential business information that gives a competitive advantage because it isn't publicly known.