14 Data Security
This chapter covers
- Encryption (symmetric/asymmetric) and hashing
- Public Key Infrastructure (PKI)
- Data states and lifecycle
- Data handling practices
Previous chapters examined the ways in which access controls, network defenses, and backups protect data assets. However, protection must follow data throughout its entire lifecycle. A file that is encrypted at rest can still be intercepted while in transit. Secure transmission means little if the data can be copied, emailed, or carried away on a USB drive. Therefore, effective data security requires multiple layers of control.
This chapter focuses on two such layers: cryptography and data loss prevention. One makes data unreadable to unauthorized parties, while the other helps prevent sensitive information from reaching them in the first place.
Cryptography is the foundation of modern data protection. Symmetric and asymmetric encryption maintain confidentiality in various contexts, and hashing and digital signatures verify integrity, establish authenticity, and support non-repudiation. Understanding these technologies requires knowing not only how they work but also the threats they are designed to counter.