Secure Data Management
Protecting data at rest and over time
This domain covers storing, backing up, and disposing of data safely.
Concepts
- Data at rest vs in transit: encryption protects both; full-disk encryption protects a stolen laptop, while transport encryption protects data on the wire.
- Access control: the principle of least privilege - give each person only the access their role needs. Strong passwords, multi-factor authentication, and prompt removal of leavers' accounts are core controls.
- Backups: follow the 3-2-1 rule - three copies, on two different media, one off-site (and offline, to resist ransomware). Test restores; an untested backup is a hope, not a control.
- Secure disposal: deleting a file or emptying the recycle bin does not erase it. Overwrite or use certified wiping tools for drives, and shred paper. Physical destruction is needed for failed drives.
- Classification: label data (public, internal, confidential) so handling rules are clear.
- Cloud and removable media: encrypt USB drives, and check that cloud storage sharing settings are not open to everyone.
Traps
- "Deleting the file removes the data" - false; recovery tools can restore it until overwritten.
- "A backup on the same drive protects against disk failure" - it does not; it is the same single point of failure.
- Confusing least privilege with denying all access; it means minimum necessary access.
- Assuming cloud providers automatically back up your data or secure your sharing links.
Rule of thumb: for any data-handling question, ask three things - who can access it, is it encrypted, and can it be recovered if lost?
Worked example: A company retires laptops containing customer records. The correct step is to securely wipe or physically destroy the drives before disposal, because ordinary deletion leaves recoverable data and would risk a confidentiality breach.