Data security is the set of technologies and standards that protect information from accidental or intentional theft, destruction, modification, or exposure. Physical security, logical controls, administrative controls, and organizational standards all play a part.
Why it matters
Any data a business collects, stores, creates, or transmits — personal, financial, or strategic — has to be protected. Social engineering still drives a large share of breaches, and smaller organizations are frequent targets. A strategy that only covers one control (for example, antivirus) is not enough.
Related: What is cloud computing security.
Common technologies
Data encryption
Encryption wraps data so only someone with the authorized key can read it. It can be symmetric or asymmetric (public-key). Use it for data at rest and data in transit.
Data masking
Also called obfuscation. Real personally identifiable information is replaced with other characters for users who should not see the original. GDPR and similar rules often require this for personal data.
Data erasure
Software overwrites storage so deleted data cannot be recovered, and the device is sanitized before reuse or disposal.
Data resilience
The ability to detect, reduce, and recover from data loss — including restoring from backup after an incident.
Compliance depends on the data
Rules differ for personally identifiable information, protected health information (HIPAA), and payment cards (PCI). Location also matters: GDPR for EU residents is one example. Related: network security vs cybersecurity vs information security.
What a strategy should include
- Patch management and frequent updates
- Redundant backup and disaster recovery
- Staff training on threats and procedures
- A tested incident response plan
- Routine audits and a yearly risk analysis
Related: What are indicators of compromise. For program development or an assessment, contact Cyber Security Resource.