Data Security

Every data security control serves one of three goals, often called the CIA triad.

Confidentiality means only authorized people and systems can read the data. Access control, encryption, and monitoring for unauthorized viewing enforce it. Integrity means the data has not been altered, corrupted or tampered with, whether by an attacker, a bug or a careless employee. Availability means the data is there and usable when a legitimate user needs it. That is why backup, redundancy, and recovery planning are also data security work.

A control that protects one goal can weaken another. Encrypting everything at the strictest level can slow the legitimate access that availability requires. Real programs balance all three goals instead of maximizing one.

Most data security programs are built from the same handful of control types, layered so that no single failure exposes the data.

Network and endpoint security adds another layer. Firewalls, device control, and patch management reduce the ways an attacker can reach the data in the first place. Anexet covers the device layer with endpoint device control.

The three terms are often used interchangeably, which causes confusion in budgets and job titles.

Data security protects data from unauthorized access or loss. It is a technical and operational function. Data privacy covers the rights individuals have over their personal data, and the rules an organization follows when it collects, uses or shares that data. It is a legal and regulatory function, expressed in laws such as GDPR or HIPAA.

Data governance is the broader framework of ownership, quality standards, and decision rights over data as a business asset. Security and privacy are two of its components, alongside areas such as data quality and metadata management. In practice the three overlap constantly. A strong data security program is what makes most privacy and governance commitments enforceable, not just aspirational.

Data moves through the same stages, from creation to destruction, and controls apply at each one. Everything starts with data classification.

1. 1

   Creation and classification

   Data is tagged by sensitivity as soon as it is created or received, so later controls know how strictly to treat it.

2. 2

   Storage

   Databases, file servers, and cloud repositories apply encryption at rest and access limits that match the classification.

3. 3

   Use and sharing

   Employees copy data, email it or upload it to collaboration tools. Most accidental and deliberate leaks happen here, so DLP and monitoring do the most work at this stage.

4. 4

   Archival

   Data no longer in active use is kept under a documented policy. This reduces the exposed surface without destroying records that must be kept.

5. 5

   Destruction

   When the retention period ends, data is deleted or the media is sanitized so it cannot be recovered. Data does not pile up indefinitely.

A blocking rule in Anexet DLP can match data by its Microsoft sensitivity label or by the content of a web transfer, using built-in patterns for bank card numbers and e-mail addresses or a custom regular expression. The two screens below show both kinds of condition.

1 / 2

• 
• 

The technical controls are well understood. Most real failures come from how they are applied.

Classification is skipped or applied inconsistently, so DLP rules and access policies end up protecting the wrong things, or nothing. Controls are configured once at rollout and never revisited, even as the organization adds new cloud services, file-sharing tools, and remote-work channels that were not in the original threat model.

Monitoring also fails when nobody reviews the logs. An incident then surfaces weeks later instead of in real time. The largest single cause of data security incidents remains the insider: an employee who takes data when leaving, a contractor who mishandles a file, or simple human error. That is why visibility into what people actually do with data closes gaps that perimeter defenses leave open. The human side of this risk is covered in insider threat detection.

Logs only help when someone reviews them. This view lists incidents that have not been viewed yet, with their status and a statistics chart. Reviewing them is the core of security incident investigation.

Start with the data that would cause the most damage if it left the company, then map the channels that this data actually uses. A policy written for every file at once tends to block ordinary work and is often switched off soon after.

Review the controls on a fixed schedule. A data security program is only as good as its last review.

Further reading: Information Security of Databases; What is Technical Information Protection?.