2.7 Protecting Data

Data has three states

Protecting data means securing it in all three states: data at rest (stored on a drive or device), data in transit (moving across a network), and data in use (actively being processed in memory). Each state needs different protections — for example, encryption is critical for rest and transit, while access controls matter most for data in use.

Encryption locks data down

Encryption converts readable data (plaintext) into unreadable data (ciphertext) using an algorithm and a key. Symmetric encryption uses one shared key for both encrypting and decrypting (fast, but key distribution is risky). Asymmetric encryption uses a public/private key pair, so the key never needs to be shared, but it's slower.

Hashing and backups protect integrity

Hashing creates a fixed-length digital fingerprint of data to verify it hasn't changed — unlike encryption, hashes can't be reversed. Regular backups (copies of data stored separately) protect against loss from ransomware, hardware failure, or disasters, supporting data availability as part of the CIA triad.

Key terms

Data at rest

Data stored on a device or drive that is not currently being transmitted or processed.

Data in transit

Data actively moving across a network, requiring protections like TLS/SSL or VPNs.

Symmetric encryption

Encryption method using one shared key for both encrypting and decrypting data.

Asymmetric encryption

Encryption method using a public/private key pair; the private key is never shared.

Hashing

A one-way process creating a fixed-length fingerprint of data to verify integrity; cannot be reversed.

Try an AP-style question

Which describes data at rest?

1. Data moving across a network
2. Data in a CPU register only
3. Data stored on a disk
4. Data being typed right now