3.3 Protect data
📘CompTIA Security+ (SY0-701)
In cybersecurity, understanding different types of data is essential because each type may have different rules, regulations, and security requirements. Knowing this helps you protect it properly.
Here’s a detailed breakdown of the main data types you need to know for the exam:
1. Regulated Data
Definition:
Data that is controlled by laws, regulations, or compliance standards. Organizations are required by law to protect this data.
Examples in IT environments:
- Personal Identifiable Information (PII): Names, addresses, social security numbers stored in a HR database.
- Health data: Medical records in Electronic Health Records (EHR) systems.
- Payment data: Credit card numbers stored in a secure payment processing system.
Key points for the exam:
- Laws like GDPR, HIPAA, or PCI-DSS dictate how this data must be stored, accessed, and shared.
- Often requires encryption, strict access controls, and audit logging.
- Mishandling regulated data can lead to legal fines and penalties.
2. Trade Secret
Definition:
Confidential business information that provides a company with a competitive advantage.
Examples in IT environments:
- Proprietary software code in a version control system (e.g., GitHub Enterprise).
- Internal algorithms or AI models stored on company servers.
- Internal business strategies saved in secure documentation systems.
Key points for the exam:
- Trade secrets must be kept confidential; sharing them outside authorized personnel can harm the company.
- Often protected through NDAs (Non-Disclosure Agreements) and strict access controls.
3. Intellectual Property (IP)
Definition:
Creative works or inventions owned by a person or organization that need legal protection.
Examples in IT environments:
- Source code for a new software product.
- Patented network design or unique database schema.
- Trademarked logos or digital assets stored in the company’s digital asset management system.
Key points for the exam:
- IP is different from trade secrets because it may be legally registered (patents, copyrights).
- Protect IP through copyrights, patents, trademarks, and access controls.
4. Legal Data
Definition:
Data that is used in legal processes, contracts, or investigations.
Examples in IT environments:
- Contract files stored in a cloud-based document management system.
- Logs from security systems that may be required for audits or litigation.
- Evidence collected for internal investigations saved in a secure case management system.
Key points for the exam:
- Often requires retention policies (how long you must keep data).
- Needs integrity protection to ensure it is admissible in court.
- Usually handled by legal or compliance departments.
5. Financial Data
Definition:
Any data related to financial transactions, accounting, or monetary value.
Examples in IT environments:
- Bank account information stored in ERP systems.
- Transaction records in online payment gateways.
- Budget and expense reports in secure company spreadsheets.
Key points for the exam:
- Requires confidentiality and integrity because financial fraud is a risk.
- Often needs encryption, access control, and regular auditing.
- Standards like SOX (Sarbanes-Oxley) may apply.
6. Human-readable vs Non-human-readable Data
Definition:
- Human-readable: Data that people can understand without special tools.
- Non-human-readable (machine-readable): Data that machines can process but humans cannot easily read.
Examples in IT environments:
- Human-readable: CSV files, Word documents, PDFs.
- Non-human-readable: Encrypted files, binary logs, database files in binary format, machine code, or compiled software executables.
Key points for the exam:
- Human-readable data is easier for people to accidentally leak, so extra caution is needed.
- Non-human-readable data can still be sensitive; even though humans can’t read it, attackers can process it with the right tools.
- Security measures include encryption, masking, and controlled access.
✅ Exam Tips for Data Types
- Regulated → law-driven protection.
- Trade secret → internal competitive advantage, not public.
- Intellectual property (IP) → legally registered creative works.
- Legal → court/evidence-related data.
- Financial → money-related, audit-controlled.
- Human-readable vs Non-human-readable → think about accessibility and sensitivity.
Tip: When a question asks about handling data in an IT environment, match the type with the proper protection methods:
- Encryption
- Access control
- Audit logs
- Retention policies
This explanation covers everything needed for the SY0-701 exam about data types while keeping it simple for non-IT learners.
