[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.2.a
AP Cybersecurity · Securing Applications and Data
Data State and Classification
State decides which control applies. Classification decides how much of it you apply.
key ideaState decides which control applies. Classification decides how much of it you apply.
The categories
[Figure: The three states, left to right: at rest on a drive, in transit across a network, and in use inside a processor. Each is protected by a different control.]
The three states, left to right: at rest on a drive, in transit across a network, and in use inside a processor. Each is protected by a different control.Two questions govern how data is protected, and they are independent. The state the data is in decides which controls are even relevant; its classification decides how strong those controls must be — and sometimes the law decides for you.
Answer both. Encrypting data at rest does nothing for the same data in transit, and a control adequate for internal notes may be non-compliant for regulated records.| State | Where the data is | What protects it |
|---|
| at rest | stored on a drive | protecting the physical drive from destruction or theft, and encrypting the data |
| in transit | moving across a network | encrypting the channel, so interception yields nothing readable |
The at-rest row carries two controls, not one. Encryption answers theft of the contents; physical protection answers destruction of the drive — and only the second addresses availability.
Data at restData stored on a drive. Protect the physical drive from destruction or theft, and encrypt the data itself.
Data in transitData moving across a network — protected by encrypting the channel it travels over.
ClassificationCategorizing data according to sensitivity, so a higher degree of security is prioritized for more sensitive information.
Regulated dataData whose storage, transmission and handling are governed by laws or regulations.
LabelingMarking regulated data so the policies that comply with the legal requirements can actually be applied to it.
Telling them apart
| Classification level | Typical degree of security | Driven by |
|---|
| public | integrity only — it is meant to be read | business need |
| internal | access control; encryption where convenient | business need |
| sensitive | strong encryption plus strict access control | business need and risk |
| regulated | labeled, with storage, transmission and handling to specific rules | laws and regulations |
Only the last row is set from outside the organization. For regulated data the required degree of security is not a judgment call — it is a legal requirement the policy must comply with.
four requirements
- At rest needs both physical protection of the drive and encryption of the data.
- In transit needs the channel encrypted — a different control entirely.
- Organizations prioritize a higher degree of security for data they classify as more sensitive.
- Laws and regulations can require specific rules for storing, transmitting and handling certain data.
At restdrive + encryption
In transitthe channel
Regulatedlabel it, then comply
Worked examples
EX 1
One record, two states
A patient record is stored on a hospital server and later sent to a specialist. What protects it in each state?
1
Identify the first state
At rest on the server's drive.
2
Give both at-rest controls
Encrypt the data, and protect the physical drive from theft or destruction.
3
Identify the second state
In transit across the network to the specialist.
4
Give the in-transit control
Encrypt the channel so interception yields nothing readable.
5
State why both are needed
Neither control covers the other state. A record encrypted at rest travels in the clear unless the channel is also protected.
EX 2
Classification sets the degree
An organization holds internal meeting notes and customers' financial records on the same file server. Should they be protected identically?
1
Classify each
Meeting notes: low sensitivity. Financial records: high, and likely regulated.
2
Apply the principle
Organizations prioritize a higher degree of security for more sensitive information.
3
State what differs
Stronger encryption, stricter access controls, and audit logging for the financial records.
4
Note the regulatory layer
Regulated data must be labeled, with policies complying with the legal requirements for storage, transmission and handling.
5
Give the answer
No — same server, different degree of protection, driven by classification rather than location.
EX 3
Why labeling comes first
A company has a strong policy for regulated data but does not label which records are regulated. What goes wrong?
1
Note what exists
A policy that complies with the legal requirements — on paper.
2
Note what is missing
Any way to tell which records the policy applies to.
3
Predict the outcome
The policy is applied inconsistently, and nobody can demonstrate compliance.
4
Apply the CED sequence
Organizations collecting regulated data label them and have policies that comply with the requirements — labeling comes first.
5
State the principle
A rule that cannot identify its own subject cannot be followed or audited.
Watch out
At rest and in transit need different controls
Encrypting a drive protects stored data. The moment it moves, the channel must be encrypted too — these are separate decisions.
Protecting the drive is not only about theft
The CED names destruction or theft. Physical protection of the drive is an availability control as much as a confidentiality one.
Classification is what makes protection proportionate
Categorizing by sensitivity is how organizations justify spending more on some data than others — and it is a prerequisite for doing so consistently.
Regulated data has to be labeled to be protected
Laws can require specific rules for storage, transmission and handling. Without labeling, the compliant policy has no way to find its subject.