Protecting Data and Devices
What this domain covers
This domain is about practical controls you apply to data and hardware.
Passwords: use long, unique passphrases; never reuse them across sites; store them in a reputable password manager. Multi-factor authentication should be enabled wherever offered. Lock screens and automatic timeouts protect unattended devices.
Updates and patching close known vulnerabilities - install operating system, browser, and application updates promptly. Antivirus/anti-malware and a firewall provide complementary protection: the firewall filters network traffic, while anti-malware scans files and activity.
Encryption protects data at rest (full-disk encryption on laptops and phones) and in transit (HTTPS, VPN). Backups should follow the 3-2-1 rule: at least three copies, on two different media, with one stored off-site. Test restores - an untested backup is an assumption.
Physical security matters too: lock devices away, avoid leaving USB drives unattended, and wipe or securely erase devices before disposal. Data classification (public, internal, confidential) determines how strongly information must be handled. Access control - strong permissions and timely removal of leavers' accounts - limits exposure.
Traps in questions
- Confusing a firewall (network traffic filtering) with antivirus (malware scanning).
- Believing encryption replaces backups; it does not restore deleted or encrypted files.
- Thinking a complex password reused everywhere is safe - reuse is the risk.
- Forgetting the human step: disposing of a device without wiping it.
Rule of thumb
For any data-protection scenario ask: is this control protecting the data at rest, in transit, or in recovery? Then pick the matching control.