1
00:00:00,000 --> 00:00:01,380
Data states.

2
00:00:01,380 --> 00:00:04,410
Understanding the different states of data is crucial.

3
00:00:04,410 --> 00:00:06,540
Each state represents a different phase

4
00:00:06,540 --> 00:00:08,189
of the data lifecycle,

5
00:00:08,189 --> 00:00:10,770
and requires specific security measures

6
00:00:10,770 --> 00:00:13,200
to protect against potential threats.

7
00:00:13,200 --> 00:00:14,910
In this lesson, we are going to discuss

8
00:00:14,910 --> 00:00:16,350
the three data states,

9
00:00:16,350 --> 00:00:20,010
data addressed, data in transit and data in use,

10
00:00:20,010 --> 00:00:21,840
and the ways you can protect your data

11
00:00:21,840 --> 00:00:23,370
in each of those states.

12
00:00:23,370 --> 00:00:25,500
First, data at rest.

13
00:00:25,500 --> 00:00:28,710
Data at rest refers to any data stored in databases,

14
00:00:28,710 --> 00:00:31,410
file systems, or other storage systems.

15
00:00:31,410 --> 00:00:33,690
This data is not actively moving

16
00:00:33,690 --> 00:00:35,850
through the network or processes.

17
00:00:35,850 --> 00:00:38,730
It's like the information stored on a computer's hard drive

18
00:00:38,730 --> 00:00:40,440
or a company servers.

19
00:00:40,440 --> 00:00:41,760
Given its static nature,

20
00:00:41,760 --> 00:00:45,270
data at rest is a prime target for threat actors, therefore,

21
00:00:45,270 --> 00:00:48,660
it is essential to employ robust security measures

22
00:00:48,660 --> 00:00:50,010
such as encryption.

23
00:00:50,010 --> 00:00:53,070
Encryption converted readable data into coded data,

24
00:00:53,070 --> 00:00:56,850
and ensures that even if unauthorized users access the data,

25
00:00:56,850 --> 00:01:00,240
they cannot understand it without the decryption key.

26
00:01:00,240 --> 00:01:02,820
There are several types of encryption methods used

27
00:01:02,820 --> 00:01:04,410
for data at rest.

28
00:01:04,410 --> 00:01:07,590
These are full disc encryption, partition encryption,

29
00:01:07,590 --> 00:01:11,280
file encryption, volume encryption, database encryption

30
00:01:11,280 --> 00:01:13,170
and record encryption.

31
00:01:13,170 --> 00:01:14,370
Full disc encryption.

32
00:01:14,370 --> 00:01:16,860
This method encrypts the entire hard drive.

33
00:01:16,860 --> 00:01:19,410
When the system is off, the data is encrypted.

34
00:01:19,410 --> 00:01:21,630
When the system is on and the user is logged in,

35
00:01:21,630 --> 00:01:23,610
the data is then decrypted.

36
00:01:23,610 --> 00:01:27,240
This can be achieved through the OS third party software

37
00:01:27,240 --> 00:01:29,400
or the disc device itself.

38
00:01:29,400 --> 00:01:32,130
Next, partition encryption.

39
00:01:32,130 --> 00:01:34,740
This method only encrypts specific partitions

40
00:01:34,740 --> 00:01:37,650
of a hard drive leaving other partitions unencrypted.

41
00:01:37,650 --> 00:01:40,770
For example, you can encrypt the D drive on your workstation

42
00:01:40,770 --> 00:01:43,170
because it includes sensitive work information

43
00:01:43,170 --> 00:01:45,930
that you do not want other people using your workstation

44
00:01:45,930 --> 00:01:46,980
to access.

45
00:01:46,980 --> 00:01:48,660
Next, file encryption.

46
00:01:48,660 --> 00:01:51,060
This method encrypts individual files.

47
00:01:51,060 --> 00:01:53,880
It's often used when specific files need to be secured.

48
00:01:53,880 --> 00:01:56,490
For example, encrypting a file on your workstation

49
00:01:56,490 --> 00:01:59,460
that includes the secret codes to your GTA cheats.

50
00:01:59,460 --> 00:02:00,750
Then volume encryption.

51
00:02:00,750 --> 00:02:04,740
This method encrypts a set of selected files or directories.

52
00:02:04,740 --> 00:02:07,020
Like the previous examples, you can select

53
00:02:07,020 --> 00:02:09,180
and encrypt multiple files and directories

54
00:02:09,180 --> 00:02:12,360
when opting for volume or folder level encryption.

55
00:02:12,360 --> 00:02:14,100
Next up, database encryption.

56
00:02:14,100 --> 00:02:17,040
This method encrypts data stored in the database.

57
00:02:17,040 --> 00:02:20,760
It can be done at the column, row or table level.

58
00:02:20,760 --> 00:02:23,190
Finally, record encryption.

59
00:02:23,190 --> 00:02:25,080
This method encrypts specific fields

60
00:02:25,080 --> 00:02:26,910
within a database record.

61
00:02:26,910 --> 00:02:29,130
This could be beneficial when multiple users

62
00:02:29,130 --> 00:02:30,960
are accessing the same database,

63
00:02:30,960 --> 00:02:34,050
but not all of them have the same access and view rights,

64
00:02:34,050 --> 00:02:37,380
and so some records would be encrypted from those users.

65
00:02:37,380 --> 00:02:39,750
Next up, data in transit.

66
00:02:39,750 --> 00:02:42,090
Data in transit, also known as data in motion,

67
00:02:42,090 --> 00:02:44,430
refers to data actively being moved

68
00:02:44,430 --> 00:02:46,410
from one location to another,

69
00:02:46,410 --> 00:02:49,860
such as across the internet or through a private network.

70
00:02:49,860 --> 00:02:52,200
This data is vulnerable to interception

71
00:02:52,200 --> 00:02:53,730
during its journey.

72
00:02:53,730 --> 00:02:55,050
To secure data in transit,

73
00:02:55,050 --> 00:02:57,930
transport or communication encryption methods are used.

74
00:02:57,930 --> 00:03:02,310
These include SSL and TLS, VPNs and IPSec.

75
00:03:02,310 --> 00:03:04,230
SSL or the secure socket layer,

76
00:03:04,230 --> 00:03:07,290
and TLS, or the transport layer security,

77
00:03:07,290 --> 00:03:09,330
are cryptographic protocols designed

78
00:03:09,330 --> 00:03:12,600
to provide secure communication over a computer network.

79
00:03:12,600 --> 00:03:15,390
They are widely used in web browsing, email

80
00:03:15,390 --> 00:03:17,250
and other data transfers.

81
00:03:17,250 --> 00:03:20,490
VPNs or virtual private networks are technologies

82
00:03:20,490 --> 00:03:24,180
that create secure connections over a less secure network,

83
00:03:24,180 --> 00:03:25,410
such as the internet.

84
00:03:25,410 --> 00:03:28,110
It ensures that data sent and received

85
00:03:28,110 --> 00:03:31,170
is encrypted and secured from prying eyes.

86
00:03:31,170 --> 00:03:34,890
Finally, IPSec or the internet protocol security.

87
00:03:34,890 --> 00:03:37,050
This protocol suite is used to secure

88
00:03:37,050 --> 00:03:40,200
the internet protocol communications by authenticating

89
00:03:40,200 --> 00:03:43,530
and encrypting each IP packet in a data stream.

90
00:03:43,530 --> 00:03:45,840
Finally, data in use.

91
00:03:45,840 --> 00:03:48,030
Data in use refers to the data in the process

92
00:03:48,030 --> 00:03:51,870
of being created, retrieved, updated, or deleted.

93
00:03:51,870 --> 00:03:55,350
In other words, it's data that's actively being processed.

94
00:03:55,350 --> 00:03:57,180
While this state is often overlooked,

95
00:03:57,180 --> 00:04:00,690
it's just as vulnerable to threats as the other states.

96
00:04:00,690 --> 00:04:02,730
Securing data in use is challenging

97
00:04:02,730 --> 00:04:06,030
because the data must be decrypted to be processed.

98
00:04:06,030 --> 00:04:08,940
Techniques such as encryption at the application level,

99
00:04:08,940 --> 00:04:11,490
access controls and secure enclaves,

100
00:04:11,490 --> 00:04:13,140
where data can be processed

101
00:04:13,140 --> 00:04:16,709
in a protected isolated environment, are commonly used.

102
00:04:16,709 --> 00:04:20,100
Also, some mechanisms like the Intel software guard

103
00:04:20,100 --> 00:04:23,220
are able to encrypt data as it exists in memory

104
00:04:23,220 --> 00:04:27,000
so that an untrusted process cannot decode the information.

105
00:04:27,000 --> 00:04:30,420
So remember, there are three data states out there:

106
00:04:30,420 --> 00:04:33,930
data at rest, data in transit, and data in use.

107
00:04:33,930 --> 00:04:36,660
Data at rest can be protected by using encryption

108
00:04:36,660 --> 00:04:38,460
and implementing ACLs;

109
00:04:38,460 --> 00:04:40,530
data in use can be protected through the use

110
00:04:40,530 --> 00:04:42,750
of communication tunneling protocol;

111
00:04:42,750 --> 00:04:44,280
data in transit can be protected

112
00:04:44,280 --> 00:04:46,770
through the use of communication tunneling protocols,

113
00:04:46,770 --> 00:04:48,480
and data in use can be protected

114
00:04:48,480 --> 00:04:51,030
by using encryption at the application level.

115
00:04:51,030 --> 00:04:53,037
Understanding the different states of data

116
00:04:53,037 --> 00:04:55,710
and the appropriate security measures for each

117
00:04:55,710 --> 00:04:58,560
is fundamental to comprehensive data protection.

118
00:04:58,560 --> 00:05:01,980
By implementing robust security measures at each state,

119
00:05:01,980 --> 00:05:04,650
organizations can significantly reduce the risk

120
00:05:04,650 --> 00:05:07,230
of data breaches and ensure the integrity

121
00:05:07,230 --> 00:05:09,363
and confidentiality of their data.