14 Data Security

Data security is presented as protection for the information itself, not just the systems that store or move it, because data often crosses devices, networks, users, and business boundaries. The chapter frames this protection around the CIA triad: confidentiality through encryption and access control, integrity through hashing and digital signatures, and availability through backups, redundancy, and retention planning. It emphasizes that effective security must travel with the data across its full lifecycle, since a file can be secure in one state and exposed in another.

Cryptography is the core technical foundation of the chapter. Symmetric encryption uses one shared key and is fast and efficient, but key distribution is difficult and risky; asymmetric encryption uses public and private key pairs, improving scalability and enabling secure key exchange, authentication, and non-repudiation, though at greater computational cost. Hashing provides a one-way method for detecting changes to data, and digital signatures combine hashing with asymmetric cryptography to prove authenticity and protect against denial of authorship. Public key infrastructure adds trust by binding public keys to verified identities through certificates, certificate authorities, and revocation mechanisms.

The chapter also explains that security depends on understanding how data is handled in different states and phases. Data at rest, in transit, and in use each face different risks and require different safeguards, while the lifecycle spans creation, storage, use, sharing, archiving, and destruction. Classification and labeling help organizations apply proportionate controls, retention policies limit unnecessary exposure, and secure destruction methods such as wiping, purging, degaussing, or physical destruction prevent recovery of discarded information. Finally, data loss prevention systems complement cryptography by monitoring and blocking unauthorized exfiltration through email, cloud services, endpoints, and removable media, though their effectiveness depends heavily on accurate labeling and visibility into data flows.

Illustration of Alice sending a confidential message to Bob using symmetric encryption

Illustration of Alice sending a confidential message to Bob using asymmetric encryption

Illustration of Alice sending a message to Bob using hashing to ensure integrity

Illustration of digital signing and verification of a document

Illustration of Alice sending a message to Bob using a Public Key Infrastructure

The secure data handling lifecycle diagram.

Overview of enterprise Data Loss Protection (DLP) architecture with centralized policies enforced on network, endpoint, and storage layers.

1. The correct answer is A. The primary purpose of encryption is to protect data from unauthorized access. Encryption transforms data into unreadable and can only be decrypted by anyone with a valid key; thus, it is used to protect data from unauthorized access and ensure the integrity of the data. Even though it can be used as a preventive measure for data breaches, it is not the primary purpose of encryption, and neither used to process data efficiently or analyze data.
2. The correct answer is B. A data retention policy is a set of guidelines that helps organizations manage their data and determine how long certain types of data should be kept. The other options do not accurately describe the primary objective of a data retention policy.
3. The correct answer is B. Digital signatures offer the security benefits of data integrity and non-repudiation. Indeed, a digital signature can be uniquely linked to a specific sender, offering an undeniable (non-repudiable) proof of the sender's identity and of the fact that the message originated from them. Moreover, when a digital signature is used, any changes made to the data after it has been signed will invalidate the signature, providing a method to check whether the data has been tampered with.
4. The correct answer is D. Overwriting involves writing multiple patterns across all storage media. This method ensures that the original data cannot be recovered. For example, if an organization wants to repurpose a hard drive, they can overwrite the drive with multiple data patterns to ensure that the original data is completely erased and cannot be recovered. The other options are methods of media sanitization, but none involves writing multiple patterns across all storage media.
5. The correct answer is A. A DLP (Data Loss Prevention) tool is designed to detect and prevent the unauthorized transfer of sensitive data outside an organization's network. These tools monitor data in use, in transit, or at rest, and apply policies to prevent the sharing or transfer of sensitive information in violation of those policies.

FAQ