RANGER GAMEZ

CompTIA Security+ (SY0-701) · chapter 13 of 27

Month 6: Know your data

In this chapter Objectives 3.3

  1. Data types and classifications
  2. Methods to secure data
  3. Chapter recap

Objective 3.3

Data types and classifications

Data types

CompTIA groups data by what it is:

  • Regulated: controlled by law or industry rules (card numbers under PCI DSS, health data, personal data under privacy laws).
  • Trade secret: valuable because it is secret (the Kibble Krunch recipe). Lose secrecy, lose protection.
  • Intellectual property: creations protected by copyright, patents and trademarks (logos, software).
  • Legal information: contracts, court records, legal advice. Financial information: bank, payroll, accounting data.
  • Human-readable (documents, screens) vs non-human-readable (binary, barcodes, encrypted blobs): both still need protection.

Data classifications

Labels tell people how to handle data. CompTIA's terms:

  • Public: no harm if disclosed (store hours, press releases).
  • Private: about a person or for internal use, not for outsiders (employee details).
  • Sensitive: could cause harm if exposed; needs protection (customer contact data).
  • Confidential: limited to approved people (contracts, pricing plans).
  • Restricted: highest handling rules; very limited access (card data, trade secrets).
  • Critical: data the business cannot run without; availability matters most.

Exam tip Exam tip: organizations pick their own labels. On the exam, look for the label that matches the harm and the handling rules described.

Data states

Data needs different protection in each state. At rest: stored on disks, databases, backups (protect with full-disk or database encryption and permissions). In transit: moving across a network (protect with TLS, IPSec, VPN). In use: loaded in memory and being processed (hardest to protect; trusted execution environments and memory protections help).

Exam tip Trap: "encrypted at rest" does not protect data while it is being processed in RAM. That is data in use.

Data sovereignty and geolocation

Data sovereignty: data is subject to the laws of the country where it is stored, so where you put it matters. Some laws, like the EU's GDPR, also limit moving personal data out of the region. Geolocation is knowing where a user or device physically is (GPS, IP location). It feeds controls like blocking logins from unexpected countries.

Objective 3.3

Methods to secure data

Encryption and hashing

Encryption scrambles data with a key so only key holders can read it; it is reversible (confidentiality). Hashing produces a fixed-length fingerprint that cannot be reversed; any change to the input changes the hash (integrity, password storage with salts).

Exam tip Trap: hashing is not encryption. You cannot "decrypt" a hash. Need the original back? Encryption. Need to prove it did not change? Hashing.

Masking, tokenization, obfuscation

Masking hides part of the data when shown (a card number shown as XXXX XXXX XXXX 4417). Tokenization swaps sensitive data for a random token; the real value lives in a separate token vault, so a stolen token is useless (common for stored card numbers). Obfuscation makes data or code hard to understand without truly securing it (scrambled code, steganography).

Real card: 4111 1111 1111 4417
Masked:    **** **** **** 4417 (display)
Token:     tok_9fQ2x7LmA1 (stored;
           the vault maps it back)

Exam tip Memory trick: masking hides on screen, tokenization replaces in storage.

Geographic restrictions, segmentation, permissions

Geographic restrictions limit where data can be accessed or stored (block logins from outside the US, keep EU data in EU regions). Segmentation keeps sensitive data on separate networks or systems (the card environment walled off from the office). Permission restrictions grant access only to the people and services that need it, using ACLs, roles and least privilege.

Check yourself 1The online shop must keep card numbers for repeat orders, but the order database should hold nothing an attacker could use. Which method fits BEST?

  1. Masking the number on the receipt screen
  2. Hashing the number with SHA-256
  3. Tokenization with a separate vault
  4. Obfuscating the database column name
Show the answer

Answer: C. Tokenization with a separate vault

Tokenization stores a random token in the database and keeps the real number in a protected vault, so a stolen database is useless and repeat charges still work.

Practice it in Ranger's Cyber PatrolThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.