3.3 Compare and contrast concepts and strategies to protect data

★ Starred in your notes: full-disk encryption = laptops/disks; full-device encryption = mobile.

Breakdown 1 — Data types and classifications

Data type	Example	Why it's special
Regulated	PHI (HIPAA), cardholder data (PCI DSS), EU personal data (GDPR)	Law dictates controls, breach notification, fines
Trade secret	Formulas, algorithms, customer lists	Loses protection if disclosed
Intellectual property	Copyright (DRM), patents (class)	Legal ownership; DRM controls copying
Legal information	Contracts, litigation	Privileged, retention rules
Financial information	Statements, card numbers, payroll	SOX/GLBA/PCI
Human- vs. non-human-readable	Documents vs. binary/encrypted/machine data	Non-human-readable still needs classification

Classifications (labels): Public · Private · Sensitive · Confidential · Restricted · Critical. Government style: Unclassified → Confidential → Secret → Top Secret. The label drives the handling rules (encryption, who may access, retention).

Breakdown 2 — Data states (class: "in motion, at rest, in use — in RAM")

State	Where	Protect with
At rest	Disk, database, backup tape	FDE/SED, file/database encryption, access control
In transit / in motion	On the network	TLS, IPsec, SSH, VPN
In use	RAM/CPU	Memory encryption, secure enclave, homomorphic encryption; cold boot attack extracts keys from RAM (class)

Sovereignty and geolocation: Data sovereignty = data is subject to the laws of the country where it is stored (GDPR is the classic example). Geolocation = knowing/controlling where data physically lives; geographic restrictions (geofencing) block access or storage outside approved regions.

From class — the information life cycle: creation/acquisition → use/storage → retention/archival → wiping/disposal. Controls apply at every stage; disposal = sanitization/destruction (4.2).

Breakdown 3 — Methods to secure data

Method	What it does	Reversible?
Encryption	Scrambles with a key	Yes, with the key
Hashing	One-way fingerprint for integrity/password storage	No
Masking	Shows only part (****1234) or substitutes fake values for display/testing	No (displayed copy)
Tokenization	Replaces value with a random token; real value in a vault	Only via the vault
Obfuscation	Makes data hard to interpret (including steganography)	Varies
Segmentation	Keep sensitive data on its own network/storage zone	—
Permission restrictions	Least privilege, NTFS/share ACLs (most restrictive wins)	—
Geographic restrictions	Only from/in approved regions	—

From class — privacy-enhancing technologies: anonymization (remove identifying data permanently), pseudo-anonymization (replace identifiers with pseudonyms; re-identifiable with a key), tokenization, data scrubbing/minimization. DLP — data loss prevention (e.g., blocking uploads to social media, stopping card numbers in email). DRM — digital rights management (copyright enforcement). Data segmentation.

From class — encryption at the device level: Full-disk encryption → laptops/disks; full-device encryption → mobile phones (if the question says "mobile"). Disk encryption options: stacked file system encryption, block-device encryption, self-encrypting drive (SED), secure enclave. Windows: EFS (per file/folder), BitLocker (whole drive, TPM-backed).

Breakdown 4 — Exam scenarios

Scenario	Best answer
Developers need realistic test data without real customer info	Masking (or anonymization)
Reduce PCI scope for stored card numbers	Tokenization
Data must stay in the EU	Data sovereignty / geographic restriction
Prevent employees emailing spreadsheets of SSNs	DLP
Laptop stolen while off	FDE
Sensitive data processed in the cloud without exposing it in memory	Secure enclave / homomorphic encryption
Analytics on personal data while limiting re-identification	Pseudonymization

Quick self-check

• Three states of data and one control for each. (At rest/FDE; in transit/TLS; in use/enclave.)
• Tokenization vs. masking? (Token reversible via vault; mask is display-only.)
• What does "data sovereignty" mean? (Local law applies where the data sits.)