Data is a crucial asset for organizations today. With data playing such a vital role, it becomes imperative to understand the various states in which data exists in order to secure it effectively. The three primary states of data are:
Data at Rest
Data at rest refers to data that is stored or archived. This includes all data that resides in databases, file servers, spreadsheets, archives, backups, etc. Essentially, any data that is not moving and resides in storage is considered data at rest.
Some examples of data at rest include:
- Data stored in databases like SQL, NoSQL, etc.
- Files stored on hard drives, SSDs, external storage, etc.
- Data archived on tapes or other offline storage
- Backups stored on external drives or in the cloud
- Information stored in spreadsheets and documents
Data at rest remains static until a user or application accesses it. It is not moving or being transmitted. This data is often encrypted and requires authentication to access it. Key concerns around securing data at rest include:
- Encrypting data to prevent unauthorized access
- Proper access controls to limit access to authorized users
- Data loss prevention in case of device failure, disasters, etc.
- Compliance with regulations around data security and privacy
Challenges with Securing Data at Rest
Some key challenges with securing data at rest include:
- Massive volumes of data make encryption difficult
- Getting access controls right in complex IT environments
- Ensuring data consistency across backups and archives
- Legacy systems contain old/weak encryption or lack encryption capabilities
- Lack of visibility into all places sensitive data resides
- Difficulty meeting various regulatory compliance requirements
- Lack of control over third-party data storage services
Best Practices for Securing Data at Rest
Some best practices for securing data at rest include:
- Encrypt data using strong standards like AES-256 bit encryption
- Restrict access with access controls, multi-factor authentication
- Limit user permissions to only allow access to necessary data
- Create privileged access management policies for admins
- Back up data regularly and encrypt backups
- Mask or tokenize sensitive data when possible
- Monitor access to detect unusual activity
- Destroy data securely when no longer needed
Data in Motion
Data in motion, also called data in transit, refers to data that is being transmitted across networks or between systems/locations. This includes data that is being transferred over:
- The internet
- Private corporate networks
- Wireless networks
- Communication links between systems
Some examples of data in motion are:
- Emails being sent/received
- Files being uploaded/downloaded from cloud services or remote servers
- Data being transferred between applications and web services
- Credit card transactions
- Live video/audio streams
- VPN connections
The key challenge with securing data in motion is that it is not controlled within a system or confined location. It is being transmitted across different mediums where eavesdropping and interception are risks. Key concerns around data in motion include:
- Encrypting data to prevent interception
- Ensuring secure transmission protocols
- Data leakage prevention
- Network security controls to prevent unauthorized access
Challenges with Securing Data in Motion
Securing data in motion presents some unique challenges, such as:
- Various transmission paths across networks
- Encryption can impact performance as data traverses networks
- Compatibility issues with encryption across different systems
- Lack of control once data leaves the internal network
- Inability to inspect encrypted data for threats
- Difficulties with key management for access controls
- Lack of visibility into Cloud App and Shadow IT usage
Best Practices for Securing Data in Motion
Some key best practices for securing data in motion include:
- Encrypt network traffic using VPNs, TLS/SSL, etc.
- Use secure protocols like SFTP, HTTPS, S/MIME
- Create data loss prevention policies
- Classify data to identify sensitive information
- Limit and monitor data egress points
- Use data masking to anonymize sensitive fields
- Enforce access controls between systems
- Configure firewalls to filter traffic
- Monitor networks for any unusual activity
Data in Use
Data in use refers to data that is currently being processed or accessed by a user or application. This includes data that is:
- Being processed in a computer’s CPU or memory
- Being used by applications/software
- Currently open and viewed by an authorized user
Some examples of data in use are:
- Files open on a user’s device
- Data being manipulated in an application
- Information displayed on a screen and viewed by a user
- Data actively queried and processed from a database
- Spreadsheets being updated by authorized users
- Apps processing data on a server
Securing data in use can be challenging as the data is no longer at rest, but actively being accessed and modified. Security controls need to protect confidentiality and integrity of the data while in memory and during processing cycles. Key concerns around securing data in use include:
- Preventing unauthorized access through access controls
- Data encryption while in use
- Memory protections to prevent data remnants
- Securing applications that process sensitive data
Challenges with Securing Data in Use
Some challenges with securing data in use include:
- Difficulty with runtime encryption as data needs to be unencrypted during processing
- Lack of control over external systems/devices that access data
- Visibility gaps into how third-party apps handle data in use
- Resource intensive security controls can impact performance
- Protecting against memory scraping malware
- Compliance risks from mishandling data in use across systems
Best Practices for Securing Data in Use
Some key best practices around securing data in use are:
- Enforce access controls and monitor user activity
- Isolate computing resources based on data sensitivity
- Encrypt data and communications between app components
- Mask sensitive data displayed on screens
- Secure and encrypt memory and cache
- Sanitize data remnants from memory after use
- Apply latest security patches to apps/systems
- Control copy, paste, printing of sensitive data
Comparing the States of Data
Here is a comparison of the key characteristics across the different data states:
| Data State | Definition | Examples | Key Concerns |
|---|---|---|---|
| Data at Rest | Data that is stored and inactive | Databases, files, archives, backups | Encryption, access controls, backups |
| Data in Motion | Data being transferred across networks | Email, downloads, web traffic | Encryption, protocols, leakage prevention |
| Data in Use | Data being actively accessed and processed | Files open, data in memory/CPU | Access controls, memory encryption, app security |
As highlighted in the comparison, each data state requires different security controls and protection methods to address its unique risks. Organizations need strategies to protect data comprehensively across all three states.
Importance of Securing Each Data State
Securing data in all its states is critical for organizations for the following reasons:
Data Breaches
Lack of adequate controls at any data state can lead to breaches such as:
- At Rest: Hacking of stored data like customer PII, credentials, trade secrets etc.
- In Motion: Man-in-the-middle attacks to intercept transactions, emails etc.
- In Use: Memory scraping attacks to lift sensitive data from RAM
Compliance
Regulations like GDPR, HIPAA, PCI DSS require protection of data across all states:
- GDPR requires encryption and pseudonymization of personal data
- HIPAA necessitates encryption of patient health data in motion
- PCI DSS mandates file-level encryption for cardholder data at rest
Reputational Damage
Data incidents lead to loss of customer trust, shareholder confidence, and market reputation. Studies show considerable drops in client retention, stock price etc. post a breach.
Fines & Legal Liabilities
Lack of security controls can result in heavy penalties from regulators. The average total cost of a data breach can run into millions of dollars for an enterprise.
Given the critical importance of securing data across all states, organizations must adopt a holistic approach and implement layered defenses for comprehensive protection.
Holistic Strategies for Securing Data
A holistic approach should include capabilities to secure data at rest, in motion, and in use. Key elements of a holistic data security strategy are:
Data Discovery & Classification
Discover all data assets across environments and classify based on sensitivity to prioritize protection.
Data Encryption
Implement strong encryption using standards like AES-256 for data at rest and in motion. Use runtime encryption for data in use.
Access & Activity Monitoring
Log and monitor access to data across states to detect suspicious patterns.
Network & Endpoint Security
Use firewalls, proxies, VPNs etc. to secure network traffic flows. Harden endpoints and protect memory.
Key Management
Centralize management of encryption keys, certificates across all data states.
Data Loss Prevention
Implement DLP controls to prevent unauthorized sharing and leakage of sensitive data.
Security Information & Event Management
Aggregate and analyze security event data for threat monitoring and incident response.
Backup & Disaster Recovery
Have tested backup and DR processes to recover from ransomware or disasters.
Third-Party Risk Management
Assess security risks from third-party vendors/services that access the data.
Ongoing Testing & Audits
Conduct audits, risk assessments, penetration testing to validate controls and address gaps.
Conclusion
Securing data at rest, in motion and in use presents unique challenges that require tailored security controls and solutions. Organizations must have comprehensive visibility over their data landscape and implement robust protections encompassing data across all states. A layered security approach aligned with leading practices, regulations, and industry standards is essential for holistic data protection. With increasing threats and stringent compliance obligations, securing data in all its states has become an imperative for modern enterprises.