In this lesson,
we will learn about Data State Protection.
Data state protection safeguards data
based on its current condition,
whether the data is stored,
being transmitted, or being actively used.
Data state protection concepts include data at rest,
data in transit, and data in use or in processing.
Data at rest refers to data that is stored on physical
or cloud-based storage systems.
Data in transit is defined as data that is being
actively transmitted over networks.
Next, data in use or data in processing
is data that is actively being accessed
or manipulated by applications.
Let's learn more about data state protection concepts,
including data at rest,
data in transit, and data in use or processing.
First, we have data at rest.
Data at rest is stored on physical devices
like thumb drives, hard drives,
solid state drives, or cloud storage.
Data at rest is not moving through networks
or being processed by applications.
It's just sitting there waiting to be used.
Common examples of data at rest include stored files,
databases, and backups.
Protecting data at rest is important
because without proper security,
anyone who gains access to the storage system can view
or steal sensitive information.
Encryption is one of the primary methods
of protecting data at rest.
The Advanced Encryption Standard, or AES,
encrypts data into ciphertext that only authorized users
with the correct cryptographic key can read.
Other protective measures include access controls
like passwords, multifactor authentication,
and specific permissions to ensure only the right people
can access the data.
There are different types of encryption for data at rest.
Which type of encryption is used
depends on how and where the data is stored.
So, let's discuss four different types of encryption,
each with different use cases.
These are disk-level encryption, block-level encryption,
file-level encryption, and record-level encryption.
First, disk-level encryption secures
an entire disk or partition
with a symmetric encryption algorithm like AES.
This encrypts the entire storage volume or drive.
However, because it uses a single encryption key
for the whole disk,
it can slow down the boot and login process.
Technologies like BitLocker for Windows
and FileVault for Mac are commonly
for disk-level encryption.
Second, block-level encryption is similar
to disk-level encryption,
but is mainly used for virtual partitions
and storage area networks.
It secures data at the block level,
providing a layer of protection
within complex storage environments.
A block is a fixed-size unit of data storage
and block level encryption secures individual blocks
of data on the storage device,
allowing for encryption of specific data segments
rather than the entire disk.
Third, file-level encryption protects
individual files on a system.
Each file can be encrypted with the same key
or a different key depending upon what is needed.
For example, at Dion Training,
employees use their own encryption keys
to protect individual files
before uploading them to a shared drive.
This way, even if other employees can see the files
on the shared drive,
they cannot access or read them
without the unique encryption key to decode them.
Fourth, and finally, we have record-level encryption.
Record-level encryption is especially useful
for high-security databases
where each record in the database
must be encrypted individually.
Record-level encryption is similar to file-level encryption,
but offers even more granular control,
allowing you to choose exactly which records to protect
and which encryption keys to use.
Both file-level and a record-level encryption
provide precise security controls,
but can slow down access
because the data must be decrypted
each time a file or record is opened.
Second, we have data in transit.
Data in transit refers to information
actively moving across networks
such as within corporate networks, over the internet,
or through wireless connections.
Data in transit is particularly vulnerable
to interception or tampering by malicious actors.
For example, when a customer enters
their credit card information on a website,
the data travels from their browser to a payment processor.
To protect this sensitive information during transmission,
organizations use secure pathways called encrypted tunnels.
One of the primary technologies used
to protect data in transit
is transport layer security, or TLS.
TLS creates an encrypted tunnel
between systems such as a user's computer and a web server.
This ensures the confidentiality
and integrity of the data as it moves
between the client and server.
For example, when you access a secure website,
TLS encrypts the connection,
ensuring any information sent between your browser
and the server is protected from unauthorized access.
Secure Sockets Layer, or SSL,
was the first technology used to protect data.
It was developed in the 1990s by Netscape
and is the predecessor of TLS.
However, SSL is now considered outdated
due to its security vulnerabilities.
Modern websites and servers use TLS,
which provides stronger encryption.
With TLS versions 1.2 and 1.3
being the recommended standards today.
TLS operates at the application layer,
also known as Layer 7
of the Open Systems Interconnection, or OSI, model.
To establish a secure connection,
the client encrypts a random identification string
using the server's digital certificate and public key.
This information is sent to the server,
which decrypts it to create a symmetric key
that both parties use to secure the connection.
This prevents attacks like on-path attacks
where an attacker can intercept and manipulate data.
TLS is not just used in web browsing.
TLS also secures other network traffic
and protocols for email, file transfers,
and remote authentication.
For example, File Transfer Protocol (FTP),
normally uses two ports for data
and control channels and is not secure.
But when secured with TLS,
the protocol now known as FTPS
or FTP over SSL secures the communication.
Despite the S in FTPS implying SSL usage,
TLS is actually the protocol that we will use.
Next, Cipher Suites play
an important role in TLS communications.
They specify the encryption algorithms used
during a secure session.
For example, a cipher suite
like ECDHE_RSA_AES128_GCM_SHA256
uses elliptic-curve Diffie-Hellman
ephemeral mode for key exchange,
RSA for digital signatures,
the Advanced Encryption Standard in the Galois/Counter Mode
with 128-bit blocks for encryption,
and it uses SHA256 for message authentication.
Using strong cipher suites
with robust algorithms is critical
for maintaining security.
Next, another widely used protocol
for protecting data in transit
is the Internet Protocol Security (IPsec).
IPsec secures data
by creating encrypted tunnels between devices
and is often used with virtual private networks or VPNs.
IPsec provides confidentiality, integrity, authentication,
and protection by encrypting data packets as they travel
between sites or from clients to servers.
IPsec uses several key components
to define its connection: protocols and modes.
IPsec protocols are authentication header
and encapsulating security payload.
Authentication Header provides authentication and integrity,
while Encapsulating Security Payload
adds encryption for confidentiality.
Next, IPsec can operate in the Transport Mode
or in the Tunnel Mode.
The Tunnel Mode is more secure because both data
and headers are encrypted,
so the Tunnel Mode is preferred for site-to-site VPNs.
To establish a secure IPsec tunnel,
a process called the Internet Key Exchange (IKE), is used.
IKE authenticates the peers
and negotiates the security associations between devices.
Security associations are sets of negotiated parameters
that include encryption and authentication protocols
to define the security attributes and keys used
to maintain a secure communication tunnel.
IKE Phase 1 involves key exchange and authentication.
IKE Phase 2 establishes the IPsec security associations
for encrypting and transmitting data securely.
The third, we have data in use.
Data in use refers to data being actively accessed,
processed, or manipulated by applications.
Unlike data at rest, which is stored on a hard drive,
or data in transit, which is moving across a network,
data in use temporarily resides in a system's memory
such as RAM or CPU registers.
This makes data in use particularly vulnerable
to attacks like memory scraping,
where attackers attempt to access data
directly from the system's memory or unauthorized access
through other applications running on the system.
For example, when you work on a document
or a financial report,
the data in use is the data that you are editing.
During this time, the information is actively processed
and held in memory,
exposing it to security risks
because traditional encryption methods often
do not protect data during active processing.
So to protect data in use,
organizations can implement in-memory encryption techniques
that encrypt data even while it is being accessed
or manipulated by applications.
For instance, CPUs with features
like advanced microdevices,
secure memory encryption can encrypt data
that is stored in memory,
safeguarding sensitive information during active use.
Intel's Software Guard Extensions take a different approach
by creating secure enclaves within applications,
isolating sensitive data from the rest of the system,
and making it resistant to memory scraping.
So remember, Data State Protection
involves safeguarding data based on its current condition,
whether it's stored, being transmitted,
or actively being used.
The three states of data are data at rest,
data in transit, and data in use or processing.
Data at rest refers to information stored on devices
or in cloud storage,
requiring encryption and access controls
to prevent unauthorized access.
Data in transit is actively moving through networks
and is protected by technologies like TLS and IPsec,
which creates secure tunnels
to keep the data safe from interception.
Finally, data in use is data that is actively being accessed
or processed in a system's memory,
making it vulnerable to certain attacks.
This data is protected
through techniques like in-memory encryption
and secure enclaves,
which help ensure sensitive information remains safe,
even while being used by applications.