3.5. Data Security Controls
💡 First Principle: The appropriate security control for data depends on two factors: the data's classification level (how sensitive it is) and its current state (where it is in the processing cycle). Data at rest needs different protection than data in transit, which needs different protection than data in use. Controls that protect one state do not automatically protect the others.
The three data states form a protection matrix with classification levels — and the exam tests whether you can apply the right control to the right state at the right classification level.
Why this matters: Questions about DLP, CASB, DRM, and encryption almost always include a scenario that requires matching the tool to the data state and context. The three tools address different scopes: DRM is content-centric, DLP is channel-centric, CASB is cloud service-centric.
⚠️ Common Misconception: "Encryption protects data everywhere once applied." Encryption at rest protects data on storage media. It does NOT protect data once it is decrypted for use (data in use) or if it is transmitted without a secure channel (data in transit). You need separate, appropriate controls for each state.
