Data Protection and Cryptography
What to know
Start with data lifecycle and classification: creation, storage, use, sharing, archival, and destruction. Controls follow classification - labeling, handling rules, retention, and secure disposal (crypto-shredding, sanitization, physical destruction). Know data states: at rest, in transit, and in use, and that each needs different controls.
Cryptography fundamentals: symmetric versus asymmetric, hashing versus encryption, digital signatures, and key management. Understand that encryption provides confidentiality, hashing provides integrity, and signatures provide authenticity and non-repudiation. Know the purpose of salts (defeat rainbow tables), initialization vectors (uniqueness, not secrecy), and key rotation. Understand certificate lifecycle, certificate authorities, and trust chains.
Key management is where most failures occur: key custody, separation of duties, hardware-backed storage, rotation, and revocation. Understand tokenization and masking as alternatives that reduce scope. Also know the difference between pseudonymization (reversible with a key) and anonymization (irreversible).
Traps
Questions confuse hashing with encryption - a hash is one-way and cannot be decrypted. Another trap: encryption without key protection is theater; if the key sits beside the data, the control fails. Beware options claiming TLS protects data at rest, or that masking is encryption. Also watch for deprecated algorithm choices presented as acceptable for legacy compatibility.
Worked example
A database backup is encrypted, but the encryption key is stored in the same backup archive. The correct finding is that key separation is missing; remediation is to move keys to a managed key service with access controls and rotation, then re-encrypt and verify restore.
Rule of thumb: the strength of encryption equals the strength of key custody - protect the key first.