CompTIA DataSys+ (DS0-001)Data and Database SecurityMedium
A financial institution is implementing a new database system that will store highly sensitive customer financial data. Regulatory compliance requires that even if an unauthorized individual gains access to the database files directly, the data must remain unreadable. Which security measure is MOST appropriate to meet this specific requirement?
- AUtilizing column-level encryption for sensitive data fields within the database.
- BConfiguring database activity monitoring (DAM) to detect suspicious queries.
- CEnforcing strong password policies and multi-factor authentication for database users.
- DImplementing robust firewall rules to restrict network access to the database server.
Show answer & explanationAnswer & explanation
Correct answer: A. Utilizing column-level encryption for sensitive data fields within the database.
To ensure data remains unreadable even if database files are directly accessed, encryption at the data element level (like column-level encryption) is most effective. This protects the data itself, not just access to the database system. Firewall rules, strong passwords, and DAM protect the perimeter and monitor activity, but don't render the data unreadable if the files themselves are compromised.
Why the other options are wrong
- B. DAM monitors database activity but does not encrypt the data at rest within the database files.
- C. Strong password policies and MFA protect against unauthorized user logins but do not encrypt the data files themselves.
- D. Firewall rules protect network access but do not encrypt the data at rest within the files.
Column-Level Encryption
A database security feature that encrypts specific columns (fields) within a database table, protecting sensitive data elements individually.
- Encrypts data at a granular level (field by field).
- Ensures data remains unreadable even if the database file is directly accessed.
- Requires decryption for legitimate application access.
- Can incur performance overhead due to encryption/decryption operations.
Memory trick: Columns are like locked drawers, even if the cabinet is stolen.