In this lesson, we will learn about Data States.
Data states are the different conditions
in which data exists.
Specifically, data can be at rest, in transit, or in use.
Each data state requires distinct methods of protection.
Let's compare data states to books in a library.
First we have data at rest,
and data at rest is like books stored on the shelves
at the library.
When books are sitting on shelves,
they're not being used just safely stored
and organized.
To protect the books,
the library locks the doors at night
ensuring that the books are secure.
Similarly, IT Data at rest
refers to information stored on servers, hard drives,
or cloud storage where it isn't actively being accessed,
but it still needs protection.
To secure data at rest tools like BitLocker for Windows
or FileVault for macOS can encrypt hard drives,
making the data unreadable
without the proper decryption key.
In addition, various cryptographic methods can be used
to protect data at rest.
Symmetric Encryption, which uses a single key
to encrypt and decrypt data,
provides strong security for that stored data.
256-bit Advanced Encryption standard or AES-256
is a widely used
and extremely difficult encryption to break.
Another useful tool
for protecting data at Rest
is Transparent Data Encryption, or TDE
Transparent Data Encryption is often used in databases
to encrypt data automatically at the storage level.
By using encryption alongside strict access control policies
and multifactor authentication,
data at rest remains protected even if the physical device
is compromised or stolen.
This is like keeping the library's doors locked
and allowing only authorized people to unlock them
and access the books inside.
Second, we have data in transit.
Data in transit can be compared to books
that have been checked out of the library
and are being transported home
by whomever checked out the book.
While on the way home, the books are more vulnerable
to being lost or damaged,
so they need a little extra care like being packed securely
and being kept track of.
In the same way IT Data in transit refers
to information being transferred over networks,
whether it's between local servers
or being sent to the cloud.
Data in transit is particularly vulnerable to interception
or tampering by malicious actors.
So to protect data in transit
encryption protocols such as Transport Layer Security,
or (TLS) encrypts data as it moves over the internet,
making it unreadable to anyone who intercepts it.
For example, when you visit a secure website
that uses HTTPS
or Hypertext Transfer Protocol over TLS,
TLS is working in the background
to keep your information safe.
Another important transit protocol is IPsec
or Internet Protocol Security.
IPsec is often used to encrypt
and secure data traveling over a Virtual Private Network
or VPN.
This provides safe communication
between devices across untrusted networks.
Other tools like Secure Shell
or SSH are used to securely transfer files between systems.
SFTP or File Transfer Protocol over SSH
ensures that file transfers are encrypted
to prevent unauthorized access.
By combining these protocols and tools,
organizations ensure that data in transit stays secure
and reaches its destination without being compromised.
Just like packing the book safely
and tracking them carefully
as they're taken home from the library.
Third and last, we have data in use.
Data in use is like someone reading a book
they've checked out and taken home.
The book is actively being handled, making it more exposed
to potential damage.
Similarly, IT data in use refers to information
that's being actively accessed or processed by users
or applications, making it more vulnerable
to unauthorized access or manipulation.
Just as the book requires careful handling.
Data in use requires strong security measures
to ensure it remains safe while it's being used.
So to protect data in use Memory Encryption,
which ensures the data is encrypted
while it's temporarily stored
in a computer's Random Access Memory or RAM
during processing could be used.
In addition to encryption, strong access controls,
such as Role-Based Access Control,
and Attribute-Based Access Control limit what users can do
with data based on their roles or specific attributes.
Access controls ensure
that only authorized individuals can interact
with sensitive data while it's in use.
Data Masking is yet another method used
to protect data in use.
For instance, when a database administrator
is viewing customer data,
they might only see partial information
such as the last four digits of a social security number.
This limits exposure to sensitive data while allowing users
to perform their tasks.
Secure Processing Environments or Secure Enclaves
provide an additional layer of protection
for data in use.
Tools like Intel SGX
or Software Guard Extensions create isolated environments
where data can be processed without being exposed
to the rest of the system.
This ensures that even if the system is compromised,
the sensitive data being processed within the secure enclave
remains protected.
By using Encryption, Access controls,
Data masking and Secure enclaves,
data in use can be effectively protected,
ensuring its integrity
and security while it's actively being processed
or accessed.
So remember,
data exists in three primary states at rest,
in transit, and in use.
Each state requires specific methods of protection
to ensure the data remains secure.
Data at Rest is stored and not actively being accessed.
So Encryption and strict Access controls keep it safe.
Data in Transit,
which is being transferred over networks
is vulnerable to interception.
So protocols like TLS and IPsec
encrypt and protect the data to prevent unauthorized access.
Finally, Data in Use,
which is being actively processed
requires strong access controls, encryption,
and secure environments like enclaves
to protect it while it's being accessed and used.