Simple explanation
Not all data deserves the same protection — a public press release and a customer's medical record shouldn't be treated the same way. This lesson covers how data is categorized and the concrete methods used to protect it based on that categorization.
Technical explanation
Data types: regulated (subject to specific law — HIPAA, GDPR, etc.), trade secret, intellectual property, legal, financial, health.
Data classifications: sensitive, confidential, public, restricted, private, critical — organizations define their own scheme, but the exam wants you to recognize that classification drives how much protection is applied.
General data state considerations:
- Data at rest — stored on disk, protected primarily via encryption.
- Data in transit — moving across a network, protected via TLS/IPSec/VPN.
- Data in use — actively being processed in memory, the hardest state to protect (relevant to secure enclave / confidential computing technology).
- Data sovereignty — data is subject to the laws of the country it's physically stored in.
- Geolocation — where data physically resides, often a compliance requirement in itself.
Methods to secure data: geographic restrictions (limiting where data can be accessed from or stored), encryption, hashing, masking, tokenization, obfuscation, segmentation, and permission restrictions.
Synonyms / related terms
| Term | Means | |---|---| | PII | Personally Identifiable Information — a common regulated data type | | PHI | Protected Health Information — regulated under HIPAA | | Data residency | Closely related to data sovereignty |
Concept Check
"A company must ensure European customer data never leaves EU data centers, per GDPR." This is a data sovereignty / geographic restriction requirement, not simply an encryption requirement — encrypting the data wouldn't satisfy the legal requirement that the data physically remain within a jurisdiction.
Interview-style Q&A
Q: Why is 'data in use' the hardest state to protect? A: "At rest, encryption protects it while sitting still. In transit, TLS protects it while moving. But to actually process data — run a calculation on it — it typically has to be decrypted in memory at some point, which is exactly when it's most exposed. Technologies like secure enclaves and confidential computing exist specifically to close that gap."
Memory trick
"Rest, Transit, Use" — say the three data states in that order and picture: a locked box (rest), an armored truck (transit), an open safe being actively used (use, the vulnerable moment).