12 Protecting Data · Security+

Exam objective 3.3: Summarize concepts and strategies used to protect data.

This objective is about the data itself rather than the networks that carry it: data types (structured and unstructured), data states (at rest, in transit, in use), classification labels, and the methods that protect data values—masking, hashing, filtering, tokenization, encryption, data transposition, deidentification, and obfuscation. It also covers data roles (owner, custodian, steward, operator, controller, subprocessor), handling on endpoints and across geographic boundaries, the data life cycle, and the compliance obligations attached to specific kinds of data.

This is a "summarize" objective. You will not be asked to configure a tokenization server, but you must recognize each concept from a description, pick the right protection method for a requirement, and identify which role or classification fits a scenario. Many questions in this area hinge on one key word —"reversible," "irreversible," "format-preserving," "on behalf of," "accountable"—so pay close attention to the distinctions this chapter draws.

Why Data Protection Is the Point

Firewalls, segmentation, and endpoint protection (Chapters 11 and 14) are barriers around data; identity and access management (Chapter 18) decides who may reach it. Data protection controls are different because they travel with the data or transform the data itself. Encryption keeps a stolen file unreadable, tokenization means a breached database holds nothing worth stealing, and a classification label tells users, DLP engines, and auditors how a document must be treated—wherever it goes.

Data Types

Structured Data

Structured data is organized according to a predefined schema, typically rows and columns with defined data types. Relational databases, spreadsheets with consistent columns, and CSV exports are structured. Every customer record has the same fields—name, address, account number, date of birth—and each field holds a predictable kind of value.

Structured data is relatively easy to protect because it is predictable: you know which column holds Social Security numbers, so you can encrypt, mask, tokenize, or restrict that column specifically.

Unstructured Data

Unstructured data has no predefined data model. Documents, email, PDFs, images, audio and video, chat transcripts, and free-text fields are unstructured, and they make up most of what organizations hold.

Unstructured data is much harder to protect. Sensitive values can appear anywhere—a card number in a support ticket, a password in a chat message—so discovery requires content inspection, OCR, document fingerprinting, and machine learning classifiers. Protection tends to be applied to the whole file or container (file encryption, rights management, labels) rather than to individual fields.

Characteristic Structured Unstructured

Organization Fixed schema, rows and columns No predefined model

Examples SQL database, CSV, ERP tables Email, documents, images, video, chat Discovery Easy; known fields and patterns Hard; content inspection and OCR needed Typical protection Column encryption, masking, tokenization File encryption, rights management, labeling, DLP Data States

Data exists in one of three states at any moment, and each needs different controls.

Figure 12.1: The three data states with their typical threats and controls Data at Rest

Data at rest is stored on persistent media: drives, databases, backup tapes, USB drives, and cloud storage. Threats include device theft, unauthorized storage access, and improper disposal. Controls include:

Full-disk encryption (FDE) such as BitLocker or FileVault, often backed by a TPM, which protects everything on a lost laptop.
Self-encrypting drives (SEDs) that implement encryption in drive hardware (the Opal standard).
Database encryption, including transparent data encryption (TDE) for whole databases and column-level encryption for specific fields.
Cloud storage encryption with provider-managed or customer-managed keys.

Data in Transit

Data in transit (data in motion) is moving across a network. The threats are eavesdropping, on-path attacks, and tampering.

Controls include TLS (HTTPS, SMTPS, LDAPS), IPsec VPNs, SSH and SFTP, WPA3 for wireless, and MACsec on wired LAN links. Chapter 3 covers the cryptographic mechanics and Chapter 11 covers secure communication channels.

Data in Use

Data in use is being actively processed: loaded into RAM, held in CPU caches, or displayed on screen. Because a system traditionally must decrypt data to compute on it, this is the hardest state to protect; memory-scraping malware and screen capture target it.

Controls include:

Trusted execution environments and secure enclaves (Intel SGX, AMD SEV, ARM TrustZone) that isolate processing, the basis of confidential computing.
Homomorphic encryption, which allows certain computations on encrypted data without decrypting it, at a high performance cost.
Endpoint protection against memory scraping, application-level masking, and privacy screens against shoulder surfing.

Exam tip

Match the threat to the state. A stolen laptop is a data-at-rest problem (answer: full-disk encryption). Sniffing on public Wi-Fi is a data-in-transit problem (answer: TLS or VPN). RAM-scraping malware on a point-of-sale terminal is a data-in-use problem (answer: secure enclave, point-to-point encryption, or tokenization so the terminal never handles the real card number).

"Rest, transit, use = Stored, Sent, Shown." Stored data needs disk or database encryption, sent data needs TLS or IPsec, and shown or processed data needs enclaves and masking.

Data Classifications

Data classification assigns a label to data based on its sensitivity (harm if disclosed) and, in some schemes, its criticality (harm if unavailable or corrupted). Classification drives encryption requirements, access, transfer rules, retention, and destruction; Chapter 22 covers the policy that defines these rules. Real organizations use only a subset of the seven labels in the objective, and meanings vary, so learn the general sense of each.

Government and Military Labels

Government schemes are hierarchical, based on the damage disclosure would cause to national security. In the United States (Executive Order 13526):

Top secret — disclosure could reasonably be expected to cause exceptionally grave damage to national security.
Secret — disclosure could cause serious damage.
Confidential — disclosure could cause damage.

Access requires both clearance and need to know (mandatory access control, Chapter 18).

Commercial Labels

Private organizations commonly use labels such as:

Public — approved for release to anyone; disclosure causes no harm. Marketing material, job postings.
Sensitive — information whose disclosure could harm the organization or individuals and that should be limited to those who need it. Often used for internal business data and personal information.
Confidential — in a commercial scheme, data restricted to specific authorized people: contracts, internal financials, customer lists, employee records.
Restricted — the highest commercial tier in many schemes; access limited to a small named group and subject to the strongest controls. Trade secrets, merger plans, cardholder data, encryption keys.

Critical

Critical describes data whose loss or corruption would stop essential business functions—regardless of whether it is secret. A manufacturing plant's control system configurations, a hospital's medication administration records, or a payment processor's transaction ledger are critical. Criticality drives availability and integrity controls: backup frequency, replication, and recovery priority (Chapter 13). A dataset can be public but critical, or restricted but non-critical.

Label Typical scheme Primary concern Example

Top secret Government Exceptionally grave damage if disclosed Intelligence sources and methods Secret Government Serious damage if disclosed Military operational plans Confidentia

Government or commercial

Damage if disclosed Contracts, salary data

Restricted Commercial Severe harm; tightly limited access Trade secrets, merger plans Sensitive Commercial Harm to organization or individuals Internal reports, PII Critical Either Loss or corruption halts operations Production database, SCADA configs Public Commercial None Press releases, brochures

Common trap

Do not assume "critical" means "most secret." Classification by sensitivity answers how bad is disclosure? Criticality answers how bad is losing it? Exam questions about backup priority or recovery order point to criticality; questions about who may read the data point to sensitivity labels.

Methods to Secure Data

The objective lists eight methods. The key distinctions are whether the method is reversible, whether it preserves the data's format, and whether the original value still exists somewhere.

Encryption

Encryption transforms plaintext into ciphertext using an algorithm and a key; anyone with the correct key can reverse it. It is the primary confidentiality control for data at rest and in transit. Symmetric algorithms such as AES protect bulk data; asymmetric algorithms such as RSA and ECC protect key exchange and signatures (Chapter 3).

Encryption is only as strong as its key management. Keys stored next to the data or hard-coded in source undermine the control; HSMs, cloud key management services, and rotation policies keep keys separate from the data.

Format-preserving encryption (FPE) produces ciphertext with the same format as the input—a 16-digit card number encrypts to another 16-digit string—so legacy systems with fixed field validation continue to work.

Hashing

Hashing runs data through a one-way function (such as SHA-256) to produce a fixed-length digest. It cannot be reversed to recover the input. Hashing protects integrity (verifying that a file or message has not changed) and is used to store passwords without storing the passwords themselves. Because hashing is deterministic, low-entropy inputs are vulnerable to dictionary and rainbow-table attacks. Password storage therefore uses salting (a unique random value per record) and slow key-stretching algorithms such as bcrypt, PBKDF2, or Argon2. An unsalted hash of a nine-digit Social Security number offers little protection—an attacker can simply hash all one billion possibilities.

Masking

Data masking hides part or all of a value by replacing characters with symbols or substitute values, such as displaying a card number as **** **** **** 4821. A call center agent can verify the last four digits without seeing the full number.

There are two broad forms:

Static data masking permanently replaces sensitive values in a copy of the data, such as a production database cloned for developers or testers. The masked copy holds realistic but fake values.
Dynamic data masking leaves the stored data intact and masks it at query or display time based on the user's role. An administrator might see the full value; a support agent sees only the last four digits.

Tokenization

Tokenization replaces a sensitive value with a non-sensitive substitute (a token) that has no mathematical relationship to the original. The real value is stored in a secured token vault. A merchant that stores tokens can process refunds and recurring charges without holding cardholder data, dramatically shrinking its PCI DSS scope.

Tokenization differs from encryption in a way the exam loves to test: a token cannot be "decrypted" with a key, because there is no algorithm to reverse. Only by compromising the vault can an attacker recover the originals. Mobile wallets such as Apple Pay use tokenization so the phone never transmits the real card number.

Figure 12.2: Tokenization replaces a card number with a random token whose original value can be recovered only from the vault

Exam tip

Requirement says "replace card numbers so that a breach of the application database exposes nothing usable, while still allowing recurring billing"? Choose tokenization. Requirement says "staff should see only the last four digits on screen"? Choose masking. Requirement says "verify integrity" or "store passwords"? Choose hashing.

Filtering

Filtering removes or blocks data that should not be present, passed on, or displayed. In data protection, filtering appears in several forms:

Content filtering and DLP inspect outbound email, uploads, and file transfers, blocking messages that contain patterns such as card numbers or labels such as Restricted.
Query and result filtering returns only the rows or columns a user is entitled to see (row-level security in a database, or an API that strips fields before responding).
Output filtering in applications and AI systems, such as a chatbot guardrail that prevents disclosure of customer records.

Filtering is different from masking: filtering removes or blocks the data entirely, while masking keeps a placeholder in its place.

Data Transpose

Data transposition rearranges data rather than replacing it, reordering characters, fields, or records so that values are scrambled or disconnected from identities—for example, shuffling a salary column among the rows of a test dataset so each record holds a real value belonging to someone else. The idea comes from transposition ciphers, which permute the order of characters rather than substituting them. Transposition preserves statistical properties (averages are unchanged) but reuses the original values, so it is weaker than tokenization or encryption: if the pattern is known, the data can be restored. Treat it as an obfuscation and test-data technique, not strong confidentiality protection.

Deidentification

Deidentification removes or alters identifying information so a dataset can be used for research, analytics, or sharing with reduced privacy risk. Related terms include:

Anonymization — irreversibly removing identifiers so that individuals cannot be re-identified by any reasonable means. Truly anonymized data generally falls outside privacy regulations such as

Gdpr.

Pseudonymization — replacing identifiers with pseudonyms (such as a patient ID instead of a name) while keeping a separate key that allows re-identification by authorized parties. GDPR still treats pseudonymized data as personal data.
HIPAA deidentification — the U.S. health privacy rule offers two methods: the Safe Harbor method (remove 18 listed identifiers, such as names, full dates, small geographic units, phone numbers, and record numbers) and the Expert Determination method (a qualified statistician certifies that re-identification risk is very small).

The danger is re-identification through linkage: ZIP code, birth date, and sex together uniquely identify most people. Generalization (age ranges instead of birth dates) and suppression of rare values reduce this risk.

Obfuscation

Obfuscation is the umbrella term for making data or code difficult to understand without necessarily making it cryptographically secure. Masking, tokenization, transposition, and deidentification are all forms of data obfuscation; the term also covers code obfuscation (making reverse engineering harder) and steganography (hiding data inside other data). As an exam answer, obfuscation usually means disguising data to deter casual viewing, in contrast to strong, key-based encryption.

Method Reversible? Original value retained? Typical use

Encryption Yes, with key Yes, as ciphertext Data at rest and in transit Hashing No No (digest only) Integrity checks, password storage

Masking (static) No, in the masked copy Not in the copy Test and development data Method Reversible? Original value retained? Typical use

Masking (dynamic)

Not by the viewer Yes, in storage Role-based display

Tokenization Only via the vault Yes, in the vault Payment cards, reducing compliance scope

Filtering Not applicable Removed or blocked DLP, row-level security, AI output Data transpose Yes, if pattern known Yes, rearranged Test data, analytics Deidentification Anonymization no; pseudonymization yes

Depends on method Research, analytics, sharing

Obfuscation Varies Varies Deterring casual analysis

Real-world scenario

A health insurer wants to give a university researcher three years of claims data to study diabetes outcomes. The privacy office removes names, member numbers, and street addresses; replaces each member with a random study ID; generalizes birth dates to birth year; and truncates ZIP codes to the first three digits. The insurer keeps the mapping table between study IDs and member numbers in a separate, restricted system in case a data-quality issue must be traced. Because a mapping exists, this is pseudonymization rather than anonymization, and the data is still regulated personal health data in the insurer's hands.

Data Roles and Responsibilities

Clear assignment of responsibility turns a classification policy into practice. Several of the six roles come from privacy law and carry legal obligations.

Data Owner

The data owner is a senior business person (not usually IT) who is ultimately accountable for a data set —the vice president of HR owns employee records. The owner decides the classification, approves access, sets protection and retention requirements, and accepts residual risk.

Data Custodian

The data custodian handles the day-to-day technical implementation of the owner's decisions: applying permissions, running backups, managing encryption, patching storage. Custodians are typically IT staff, DBAs, or a cloud provider. The custodian carries out access decisions but does not make them.

Data Steward

The data steward is responsible for data quality, meaning, and proper use: maintaining metadata, definitions, and lineage, ensuring accuracy, and confirming the data is used in line with policy and regulation. Stewards are often business subject-matter experts.

Data Operator

The data operator is the person or system that performs routine operations on the data: entering records, running reports, executing jobs. Operators follow the procedures others define—think of a claims processor or a nightly batch job—so their access should be least privilege and their actions logged.

Data Controller

The data controller is a privacy-law role (defined in GDPR and similar laws) for the organization that determines the purposes and means of processing personal data. The controller decides why the data is collected and how it will be used, and it bears primary legal responsibility for compliance, including honoring data subject rights and reporting breaches. A retailer collecting customer data for its loyalty program is the controller.

A data processor processes personal data on behalf of the controller and on its instructions—for example, an email-marketing service sending the retailer's campaigns (see Chapter 25).

Subprocessor

A subprocessor is a third party engaged by a processor to carry out part of the processing on the controller's behalf. If the email-marketing service uses a cloud hosting provider to store mailing lists, that hosting provider is a subprocessor. Under GDPR, a processor may engage subprocessors only with the controller's authorization, must flow down the same data protection obligations by contract, and remains liable to the controller for the subprocessor's performance. Reviewing vendors' published subprocessor lists is part of third-party risk management (Chapter 24).

Role Key word Responsibility Example

Owner Accountable Classifies data, approves access, accepts risk VP of HR for employee records Custodian Implements Technical protection, backups, permissions Database administrator Steward Quality Accuracy, definitions, proper use Business data analyst Operator Performs Routine processing following procedure Claims processor, batch job Controller Purposes and means

Decides why and how personal data is processed Retailer collecting customer data Subprocess

Engaged by processor

Performs delegated processing under contract Hosting provider used by a SaaS vendor

Owner Owns the decision. Custodian Carries it out. Steward Sees to quality. Operator Operates daily. Controller Chooses why. Subprocessor is the Sub-contractor of the processor.

Common trap

A common trap: a question describes the person who "determines the classification and approves access requests." That is the data owner, not the custodian, even though the custodian is the one who actually configures the permissions.

Data Handling

Endpoints

Endpoints are where users create, view, and copy data, making them the most common point of loss. Controls include:

Full-disk encryption so that lost devices do not become breaches.
Endpoint DLP agents that block copying labeled data to USB drives, personal cloud storage, or unapproved applications.
MDM and containerization that separate corporate from personal data and allow selective remote wipe (Chapter 14).
Removable media restrictions, and VDI so sensitive data never lands on the device at all.

Marking and Labeling

Labeling attaches classification metadata to data so that both people and systems know how to treat it. Marking is the visible indication: headers and footers reading "CONFIDENTIAL," watermarks, banners in email subject lines, and physical stickers on media and equipment.

Effective labels are both human-readable and machine-readable. Tools such as Microsoft Purview embed a label in file metadata so that DLP, email gateways, and CASBs can enforce rules ("Restricted documents cannot be emailed externally") and apply encryption automatically. Labels may be applied manually, by default, or automatically from content inspection. Physical media such as backup tapes must be marked too.

Geofencing

Geofencing uses location data (GPS, Wi-Fi positioning, cell towers, or IP geolocation) to define a virtual boundary and trigger or restrict actions based on whether a device or user is inside it. For data protection, geofencing can:

Allow access to sensitive applications only on premises or within a permitted country.
Block sign-ins or downloads from regions where the organization does not operate.
Lock or wipe a corporate container if a device leaves an approved area.

VPNs and GPS spoofing can defeat naive geofencing, so it should be one signal among several in conditional access decisions.

Data Location

Data location refers to where data physically resides—which country, region, data center, or device. Location matters because laws apply based on geography:

Data sovereignty is the principle that data is subject to the laws of the country in which it is stored (and sometimes of the provider's home country).
Data residency requirements oblige organizations to keep certain data, such as citizens' health or financial records, within specific borders.
Cross-border transfer rules, such as GDPR's restrictions on transfers outside the European Economic Area without safeguards like standard contractual clauses, govern movement between locations.

Data Placement

Data placement is the deliberate decision about where to store or process data to satisfy security, legal, performance, and resilience requirements. Placement decisions include:

Choosing cloud regions that satisfy residency requirements.
Keeping regulated data in a segmented environment (such as a PCI cardholder data environment) to limit compliance scope.
Placing backups in a different region for resilience while staying within permitted jurisdictions (Chapter 13).
Deciding which data may be sent to third-party services, including AI tools, at all.

Exam tip

Data location is the fact of where data is and which laws therefore apply. Data placement is the decision about where to put it. Geofencing is the enforcement of boundaries for devices and users based on their location.

The Data Life Cycle

Protection requirements change as data moves through five phases.

Figure 12.3: The five phases of the data life cycle and the key controls in each Creation

Data is created or collected: a user writes a document, a form captures customer details, or data is acquired from a third party. This is the best moment to apply protection, because controls applied at creation follow the data everywhere: classification and labeling, data minimization, establishing a lawful basis for personal data, and assigning an owner.

Management

During management, data is stored, used, and maintained. Controls include access control and reviews, encryption at rest, backups, monitoring, keeping classification current, and maintaining quality.

Distribution

Distribution is sharing data internally or externally—reports to partners, mobile sync, APIs. Controls include encryption in transit, DLP, rights management that persists after a file leaves the organization, data processing agreements and NDAs, and checks that the transfer is legal.

Retention

Retention keeps data for as long as required by law, regulation, contract, or business need—and no longer. A retention schedule specifies how long each data type is kept. Retention also covers archiving and legal holds, which suspend normal deletion when data may be relevant to litigation (Chapter 25). Over-retention is a risk in its own right: data you no longer need can still be breached and must still be produced in discovery.

Disposal

Disposal securely destroys data at the end of its life so that it cannot be recovered. Methods depend on media and classification, guided by NIST SP 800-88:

Clear — overwriting with non-sensitive data using standard commands; protects against simple recovery tools.
Purge — techniques such as cryptographic erasure (destroying the encryption key of a self-encrypting drive), secure erase commands, or degaussing magnetic media, which defeat laboratory recovery.
Destroy — physically shredding, pulverizing, disintegrating, or incinerating media. Obtain a certificate of destruction from disposal vendors; Chapter 15 covers decommissioning further.

Common trap

Degaussing works on magnetic media (hard disk platters, tapes) but not on SSDs or flash. For SSDs, use cryptographic erasure, a manufacturer secure-erase command, or physical destruction. Simple file deletion or reformatting is never adequate for sensitive data.

Compliance Drivers for Data Protection

Many data protection requirements flow from laws, regulations, and contracts that apply to particular kinds of data. Chapter 25 covers compliance programs; here the focus is recognizing which rules apply to which data.

Standards

Industry standards set mandatory or expected controls, sometimes by contract rather than by law. The most important for this objective is the Payment Card Industry Data Security Standard (PCI DSS), which any organization that stores, processes, or transmits cardholder data must follow through its agreements with card brands and acquiring banks. PCI DSS requires rendering the stored primary account number unreadable (encryption, truncation, tokenization, or hashing), never storing sensitive authentication data such as the CVV after authorization, encrypting cardholder data over open networks, and restricting access by need to know. ISO/IEC 27001 and 27701 are other relevant standards.

Health Data

In the United States, HIPAA protects protected health information (PHI) held by covered entities (providers, health plans, clearinghouses) and their business associates, requiring administrative, physical, and technical safeguards and breach notification; the HITECH Act strengthened enforcement. Under GDPR, health data is a "special category" requiring additional justification for processing.

Personal Information

Personally identifiable information (PII) identifies an individual directly (name, government ID, biometrics) or in combination with other data. Laws include the EU's GDPR, California's CCPA/CPRA, and Canada's PIPEDA. Common obligations include a lawful basis for collection, minimization, data subject rights (access, correction, deletion), safeguards, and timely breach notification—72 hours to the supervisory authority under GDPR.

Financial Data

In the United States, the Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customers' nonpublic personal information. The Sarbanes-Oxley Act (SOX) requires public companies to maintain internal controls over financial reporting, making the integrity of financial data an audit concern.

Child and Minor Data

Children cannot meaningfully consent, so their data receives extra protection. The U.S. Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent before collecting personal information online from children under 13, and FERPA protects student education records. GDPR sets the default age of digital consent at 16 (member states may lower it to 13).

Intellectual Property

Intellectual property (IP) includes trade secrets, patents, copyrights, source code, and designs. Trade secret law protects information only if the owner takes reasonable measures to keep it secret, so classification, access control, NDAs, and DLP are legal prerequisites as well as good practice. IP theft is a major motive of insiders and nation-state actors (Chapter 5).

Legal Data

Legal data includes privileged attorney-client communications, litigation files, contracts, and evidence. It needs confidentiality (privilege can be waived by improper disclosure) and integrity (evidence must be preserved with chain of custody, Chapter 21). Legal hold and e-discovery obligations override normal retention and disposal schedules.

Data category

Example laws or standards Key obligations

Payment cards (standard)

PCI DSS Protect stored PAN, never store CVV, encrypt in transit, segment CDE Health HIPAA, HITECH, GDPR special category

Safeguards for PHI, business associate agreements, breach notification

Personal GDPR, CCPA/CPRA, PIPEDA Lawful basis, data subject rights, minimization, breach notification Data category

Example laws or standards Key obligations

Financial GLBA, SOX Protect customer NPI, internal controls over financial reporting Child/minor COPPA, FERPA, GDPR Parental consent, age verification, minimization Intellectual property

Trade secret, copyright, patent law

Reasonable secrecy measures, NDAs, access control

Legal Privilege rules, e-discovery rules

Confidentiality, preservation, legal hold, chain of custody

Exam tip

If a question mentions a merchant that accepts credit cards, think PCI DSS, tokenization, and segmentation to reduce scope. If it mentions patient records in the United States, think HIPAA and PHI. If it mentions EU residents' data, think GDPR, controller and processor, and data residency. If it mentions a website aimed at children under 13, think COPPA and parental consent.

Chapter Summary

Structured data follows a fixed schema and is protected at the field level; unstructured data (documents, email, media) needs content inspection, labeling, and file-level protection.
Data exists at rest (stored; use FDE, SEDs, database encryption), in transit (moving; use TLS, IPsec, SSH), and in use (processing; use secure enclaves, confidential computing, masking).
Classification labels reflect sensitivity (public, sensitive, confidential, restricted, secret, top secret) or criticality (critical). Sensitivity concerns disclosure; criticality concerns loss of availability or integrity.
Encryption is reversible with a key; hashing is one-way; masking hides values for display or test copies; tokenization substitutes values stored in a vault; filtering removes or blocks data; data transposition rearranges values; deidentification removes identifiers (anonymization is irreversible, pseudonymization is reversible); obfuscation is the umbrella term for disguising data.
The owner is accountable and decides; the custodian implements; the steward ensures quality and proper use; the operator performs routine processing; the controller determines purposes and means of processing personal data; a subprocessor is engaged by a processor and bound by flowed-down obligations.
Handling controls include endpoint DLP, marking and labeling, geofencing, data location (sovereignty and residency), and data placement.
The data life cycle runs from creation through management, distribution, and retention to disposal; protection should start at creation, and disposal must use clear, purge, or destroy methods appropriate to the media.
Compliance drivers include standards (PCI DSS), health (HIPAA), personal (GDPR, CCPA), financial (GLBA, SOX), child/minor (COPPA), intellectual property, and legal data (privilege, legal hold).

Key Terms

Structured data; unstructured data; data at rest; data in transit; data in use; full-disk encryption; self-encrypting drive; transparent data encryption; confidential computing; secure enclave; homomorphic encryption; data classification; public; sensitive; confidential; restricted; secret; top secret; critical; encryption; format-preserving encryption; key management; hashing; salting; key stretching; static data masking; dynamic data masking; tokenization; token vault; filtering; data transposition; deidentification; anonymization; pseudonymization; re-identification; obfuscation; data owner; data custodian; data steward; data operator; data controller; data processor; subprocessor; endpoint DLP; marking; labeling; geofencing; data sovereignty; data residency; data location; data placement; data life cycle; retention schedule; legal hold; clear; purge; destroy; cryptographic erasure; certificate of destruction; PCI DSS; HIPAA; PHI; PII; GDPR; CCPA; GLBA; SOX; COPPA; intellectual property.

Review Questions

1. An online retailer wants to stop storing credit card numbers in its order database while still supporting one-click repeat purchases and refunds. A breach of the order database should expose nothing that can be used or mathematically reversed. Which method BEST meets this requirement?

A. Hashing
B. Tokenization
C. Dynamic data masking
D. Format-preserving encryption

2. A company's development team needs a copy of the production customer database for testing. The security team requires that the copy contain realistic-looking values but no real customer data. Which method should be used?

A. Dynamic data masking
B. Static data masking
C. Transparent data encryption
D. Geofencing

3. Malware on a retail point-of-sale terminal reads card numbers from memory immediately after the card is swiped. Which data state is being targeted?

A. Data at rest
B. Data in transit
C. Data in use
D. Data in archive

4. The vice president of sales decides that the customer pipeline report should be classified as Confidential and approves which teams may read it. The database administrator then configures the permissions. Which roles do these two people hold, respectively?

A. Data steward; data operator
B. Data controller; data processor
C. Data owner; data custodian
D. Data custodian; data owner

5. A European company uses a U.S. SaaS provider to process customer support tickets. The SaaS provider stores ticket attachments with a separate cloud storage company. What is the cloud storage company's role relative to the European company's personal data?

A. Data controller
B. Data owner
C. Subprocessor
D. Data steward

6. A university research team receives patient data in which names have been replaced with random study IDs. The hospital keeps a table that maps study IDs back to medical record numbers. Which statement is MOST accurate?

A. The data is anonymized and no longer subject to privacy regulations.
B. The data is pseudonymized and can be re-identified by the hospital.
C. The data is tokenized and protected by PCI DSS.
D. The data is hashed and cannot be linked to individuals.

7. A financial firm wants its mobile banking app to allow wire transfers only when the user's device is physically located in a country where the firm is licensed to operate. Which control is being described?

A. Data placement
B. Geofencing
C. Data sovereignty
D. Filtering

8. A company needs to securely dispose of several hundred solid-state drives that held restricted data. Which methods are appropriate? (Select TWO.)

A. Degaussing the drives
B. Cryptographic erasure of self-encrypting drives
C. Deleting all files and emptying the recycle bin
D. Physical shredding by a certified vendor
E. Quick-formatting each drive

9. A hospital's medication dispensing database is not especially secret, but if it became unavailable for even an hour, patient care would be disrupted. Which classification BEST describes this data for purposes of backup and recovery priority?

A. Public
B. Critical
C. Top secret
D. Restricted

10. A company's security policy requires that every document containing customer financial data display "CONFIDENTIAL" in the footer and carry embedded metadata that the DLP system reads to block external email. Which data handling practice does this describe?

A. Data transposition
B. Marking and labeling
C. Data placement
D. Obfuscation

11. A website directed at children under 13 collects names and email addresses to create accounts. Which compliance requirement MOST directly applies in the United States?

A. GLBA
B. SOX
C. COPPA
D. HIPAA

12. A company is subject to litigation, and counsel instructs IT to suspend automated deletion of email for the employees involved. Which life cycle phase is being modified, and what is the mechanism called? (Select TWO.)

A. Creation
B. Retention
C. Legal hold
D. Data placement
E. Distribution

Answers and Explanations

1. B. Tokenization replaces each card number with a random token that has no mathematical relationship to the original; the real value lives only in a secured vault, so stealing the order database yields nothing usable, yet the token can still be submitted for repeat charges and refunds. Hashing cannot be reversed for repeat charges, dynamic masking leaves real numbers stored, and format-preserving encryption is reversible by anyone who obtains the key.
2. B. Static data masking permanently replaces sensitive values in a copy of the data, which suits test and development environments. Dynamic masking leaves real data in the database, TDE shows real values to authorized users, and geofencing is unrelated to test data.
3. C. Data loaded into RAM for processing is data in use, the state targeted by memory-scraping malware. Data at rest is stored on disk, and data in transit is moving across a network. "Data in archive" is not one of the three states.
4. C. The person who classifies data and approves access is the data owner, who is accountable for it. The person who implements those decisions technically is the data custodian. Stewards focus on quality, operators perform routine processing, and controller and processor are privacy-law roles.
5. C. The European company is the controller, the SaaS provider is its processor, and the storage company engaged by the processor is a subprocessor. It does not determine the purposes of processing (controller), it is not accountable for the data set (owner), and it does not manage data quality (steward).
6. B. Replacing identifiers with pseudonyms while keeping a mapping that allows re-identification is pseudonymization. The data is therefore still personal data; anonymization would require that re-identification be impossible by reasonable means. Tokenization and hashing are not described.
7. B. Geofencing uses device location to define a virtual boundary and allow or restrict actions accordingly. Data placement is deciding where data is stored, data sovereignty is a legal principle, and filtering removes data content.
8. B, D. Cryptographic erasure destroys the encryption key so that data on a self-encrypting drive is unrecoverable, and physical shredding destroys the media entirely. Degaussing does not work on solid-state drives because they do not store data magnetically. Deleting files and quick-formatting leave data recoverable with simple tools.
9. B. Critical describes data whose loss or unavailability would halt essential operations, which drives backup and recovery priority. Public, restricted, and top secret describe sensitivity to disclosure rather than the impact of losing availability.
10. B. Visible footers are marking, and embedded metadata that systems read is labeling; together they let both people and DLP enforce handling rules. Data transposition rearranges values, data placement concerns where data is stored, and obfuscation disguises data rather than describing it.
11. C. COPPA requires verifiable parental consent before collecting personal information online from children under 13. GLBA applies to financial institutions, SOX to financial reporting of public companies, and HIPAA to health information held by covered entities and business associates.
12. B, C. Suspending normal deletion modifies the retention phase, and the mechanism is a legal hold, which preserves potentially relevant data for litigation regardless of the normal retention schedule. Creation and distribution are other phases unaffected here, and data placement concerns where data is stored.