CompTIA SecurityX (CAS-005)Security ArchitectureEasy
A security architect is reviewing an existing application's data flow to identify potential vulnerabilities. The application processes user input, stores it in a database, and then displays it to other users. Which of the following data security principles is MOST relevant to mitigating risks associated with data in transit and at rest in this scenario?
- ARole-based access control (RBAC)
- BInput validation and output encoding
- CData encryption and integrity controls
- DData minimization and retention policies
Show answer & explanationAnswer & explanation
Correct answer: C. Data encryption and integrity controls
Data encryption protects data in transit (e.g., TLS for communication) and at rest (e.g., database encryption) from unauthorized disclosure. Integrity controls (e.g., hashing, digital signatures) ensure that data has not been tampered with, directly addressing risks to data in transit and at rest.
Why the other options are wrong
- A. RBAC controls who can access data, but it doesn't protect the data itself from being read or altered if an authorized user's credentials are compromised or if the data is intercepted.
- B. Input validation and output encoding primarily mitigate injection and cross-site scripting (XSS) vulnerabilities, protecting the application logic and presentation, rather than the confidentiality and integrity of the data itself during transit or rest.
- D. Data minimization and retention policies are important for reducing the attack surface but do not directly address the protection of data that must be stored or transmitted.
Data Encryption & Integrity
Data encryption is the process of converting data into a coded format to prevent unauthorized access. Data integrity ensures that data has not been altered or corrupted and remains accurate and complete.
- Encryption protects confidentiality for data at rest and in transit.
- Integrity controls (e.g., hashing) detect unauthorized modifications.
- Both are crucial for protecting data throughout its lifecycle.
- Often implemented together for comprehensive data protection.
Memory trick: Keep your secrets locked and verify they haven't been touched.