CoreQ Academy3.3 Compare and contrast concepts and strategies to protect data.
You cannot protect data you have not identified. Classify it, know its state, know where it lives and which laws apply, then pick the protection method that fits.
Data types
- Regulated
- Data covered by law or regulation, such as health records (HIPAA), card data (PCI DSS), personal data (GDPR).
- Trade secret
- Confidential business information that gives a competitive edge, such as a formula or algorithm.
- Intellectual property
- Creations of the mind protected by patents, copyright and trademarks.
- Legal information
- Contracts, case files and legal communications.
- Financial information
- Account numbers, statements, payroll and transaction data.
- Human-readable and non-human-readable
- Data people can read (documents) versus machine formats (binary, encoded). Non-human-readable data can still be sensitive and evade simple DLP rules.
Data classifications
- Sensitive
- Data that would cause harm if disclosed, such as personal information.
- Confidential
- For internal use by authorised people only.
- Public
- Approved for anyone; no harm if released.
- Restricted
- Highest sensitivity; access tightly limited and monitored.
- Private
- Personal or internal data not meant for public release.
- Critical
- Data essential for operations; loss would stop the business.
General data considerations
- Data at rest
- Stored on disk, in databases or backups. Protect with encryption and access control.
- Data in transit
- Moving across networks. Protect with TLS, IPsec, SSH.
- Data in use
- Being processed in memory. Hardest to protect; secure enclaves and confidential computing help.
- Data sovereignty
- Data is subject to the laws of the country where it is stored.
- Geolocation
- Where data or users physically are, used for compliance and access decisions.
Methods to secure data
- Geographic restrictions
- Limiting where data can be stored or accessed from.
- Encryption
- Makes data unreadable without the key.
- Hashing
- Verifies integrity and stores passwords safely.
- Masking
- Hides part of the data for display or testing.
- Tokenization
- Replaces data with a token; real value kept in a vault.
- Obfuscation
- Making data or code hard to understand without changing its function.
- Segmentation
- Keeping sensitive data in separate, more tightly controlled zones.
- Permission restrictions
- Granting access only to those who need it.
Check your understanding
Knowledge quiz · pass mark 80%
- A European company must keep citizen data inside the EU because of local law. This is:
- Showing only the last four digits of a card number on a receipt is:
- Which are regulated data examples? (choose all)
- Data classified as public needs no integrity protection.
- A customer record being processed in application memory is data:
Original CoreQ Academy material, mapped to objective 3.3 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.