Data security

Short description: Process of securing digital information

Not to be confused with Data privacy.

Data security or data protection is the process of securing digital information to protect it from online threats. Data security or protection means protecting digital data, such as those in a database, from destructive forces and from the unwanted actions of unauthorized users,[1] such as a cyberattack or a data breach.[2] Data security protects computer hardware, software, storage devices, and the data of user devices. Data security also protects the data of organizations, companies and administrative controls.

Data security guarantees the protection of individual data, such as identity documents and bank data, and protects against unauthorized access, theft and loss of individual data. Data security also protects data breaches that occurs in companies and industries. Good security measures in industries reduce the probability of data breaches, and employees can rely on the company with their data and private information to be kept secured while companies can continue to maintain a stable reputation.[3]

The CIA Triad (Confidentiality, Integrity, and Availability) is what is used to practice what an information security is required to follow. Confidentiality, protects information from being accessed unauthorized; Integrity, makes sure data is trustworthy; and Availability, meaning that data can be accessed by approved users when it is needed; are three goals for data security.[4] Non-repudiation in data security definition, is a device/service that shows where the data originated from and the proof of integrity.[5]

## Contents

* 1 Technologies
* 1.1 Disk encryption
* 1.2 Software versus hardware-based mechanisms for protecting data
* 1.3 Backups
* 1.4 Data Privacy
* 1.5 Data masking
* 1.6 Data erasure
* 2 Threats
* 2.1 Malware
* 2.2 Phishing
* 3 International laws and standards
* 3.1 International laws
* 3.2 International standards
* 4 Safeguards
* 5 See also
* 6 References
* 7 External links

## Technologies

### Disk encryption

Main article: Disk encryption

Disk encryption refers to encryption technology that encrypts data on a hard disk drive. It takes data from a storage device and coverts it into an unreadable format. Disk encryption typically takes form in either software (see disk encryption software) or hardware (see disk encryption hardware) which can be used together. Disk encryption is often referred to as on-the-fly encryption (OTFE) or transparent encryption. Full disk encryption encrypts each individual sector of a disk volume. Files and user data are encrypted to hinder unauthorized users from accessing without a decryption key. A diversifier permits a plaintext of a specific disk sector to be encrypted into different ciphertexts, which does not require additional storage, such as an initialization vector (IV) or message authentication code (MAC).[6]

### Software versus hardware-based mechanisms for protecting data

Software-based security solutions encrypt the data to protect it from theft. However, a malicious program or a hacker could corrupt the data to make it unrecoverable, making the system unusable. Hardware-based security solutions prevent read and write access to data, which provides very strong protection against tampering and unauthorized access.[7]

Hardware-based security or assisted computer security offers an alternative to software-only computer security. Security tokens such as those using PKCS or a mobile phone may be more secure due to the physical access required in order to be compromised.[8] Access is enabled only when the token is connected and the correct PIN is entered (see two-factor authentication). However, dongles can be used by anyone who can gain physical access to it. Newer technologies in hardware-based security solve this problem by offering full proof of security for data.[9]

Working off hardware-based security: A hardware device allows a user to log in, log out and set different levels through manual actions. Many devices use biometric technology to prevent malicious users from logging in, logging out, and changing privilege levels. The current state of a user of the device is read by controllers in peripheral devices such as hard disks. Illegal access by a malicious user or a malicious program is interrupted based on the current state of a user by hard disk and DVD controllers making illegal access to data impossible.[10] Hardware-based access control is more secure than the protection provided by the operating systems as operating systems are vulnerable to malicious attacks by viruses and hackers. The data on hard disks can be corrupted after malicious access is obtained. With hardware-based protection, the software cannot manipulate the user privilege levels. A hacker or a malicious program cannot gain access to secure data protected by hardware or perform unauthorized privileged operations. This assumption is broken only if the hardware itself is malicious or contains a backdoor.[11] The hardware protects the operating system image and file system privileges from being tampered with. Therefore, a completely secure system can be created using a combination of hardware-based security and secure system administration policies.

### Backups

Main article: Backup

Backup is the process of reproducing copies of essential data and storing in a separate, secured place. It is used to ensure data that is lost can be recovered from another source. Backups contains a minimum of one copy of the data that requires preservation.[12] It is considered essential to keep a backup of any data in most industries and the process is recommended for any files of importance to a user.[13]

There are 3 types of backups; full backups, incremental backups, and differential backups. Full backups secure all data from a production system, such as a server, database, or other connected data source. It is impossible to lose all data in a full backup if a breach or corruption were to occur. Full backups require a significantly large amount of time to back up and may be time-consuming taking hours to days to complete.[14] Incremental backups only secures changed data since last backup. While all backups are done in full backups, incremental backups only save data that is recently or frequently changed. Incremental backups require lower storage costs making it a prominent solution for growing datasets.[15]

### Data Privacy

Data privacy (or information privacy) is the right for individual's data to be secured to obstruct the use of unauthorized access. It gives individuals control over their data and how it can be shared to third parties. The U.S Privacy Protection Law (see Privacy laws of the United States) requires organizations to inform individuals of how their data is collected and when a data breach occurs.[16] By implementing an encryption, it ensures that private data is unreadable to cybercriminals.[17]

### Data masking

Main article: Data masking

Data masking of structured data is the process of obscuring (masking) specific data within a database table or cell to ensure that data security is maintained and sensitive information is not exposed to unauthorized personnel.[18] This may include masking the data from users (for example so banking customer representatives can only see the last four digits of a customer's national identity number), developers (who need real production data to test new software releases but should not be able to see sensitive financial data), outsourcing vendors, etc.[19] Data masking is a form of encryption, as it obscures data by modifying particular letters and numbers to keep data concealed and protected from potential hackers. The individual that has access to the code that decrypts the replaced characters are the only ones that can uncover the data. [20]

### Data erasure

Main article: Data erasure

Data erasure (or data deletion, data destruction) is a method of software-based overwriting that permanently clears all electronic data residing on a hard drive or other digital media to ensure that no sensitive data is lost when an asset is retired or reused. [21] Article 17: Right to be Forgotten states that users have the right to permanently remove all of their private information from their old devices/services to give people more control over their data. Users are able to switch between devices efficiently.[22]

## Threats

### Malware

Malware (or malicious software) is designed to destroy, corrupt or gain unauthorized access to a computer for the purpose of stealing, or destroying data.[23] Hackers who use malware typically utilize many types of malware, which includes computer virus, computer worms, ransomware, spyware and Trojan horse to create a vast system of disruption and cause easy data theft.[24] One of the victims of the vast system of disruption includes healthcare workers, who are targeted by compromised systems by infections and then having their data attacked. [25]

### Phishing

Phishing is a type of scam that allows hackers to hoax people using psychological and social engineering (using human emotions such as their trust and fear) tactics into giving personal data through emails and messages, and install computer viruses if the individual were to click on a malicious link unknowingly. Attackers are able to create websites that are very similar to original websites, which makes it difficult to detect a fake website, causing individuals to fall for giving in information. [26] Phishing attackers use human emotion to exploit them, such as making them feel fear, urgency, sympathy with the message being sent by the sender. [27] Emails (Or Email spoofing) with impersonated companies and fake websites copying the original are ways to exploit people. Email spoofing show false names and emails of the original ones to copy several banks, companies and agencies, using warnings to manipulate people into feeling urgent about the email. [28]

## International laws and standards

### International laws

In the UK, the Data Protection Act is used to ensure that personal data is accessible to those whom it concerns, and provides redress to individuals if there are inaccuracies.[29] This is particularly important to ensure individuals are treated fairly, for example for credit checking purposes. The Data Protection Act states that only individuals and companies with legitimate and lawful reasons can process personal information and cannot be shared. Data Privacy Day is an international holiday started by the Council of Europe that occurs every January 28. [30]

Since the General Data Protection Regulation (GDPR) of the European Union (EU) became law on May 25, 2018, organizations may face significant penalties of up to €20 million or 4% of their annual revenue if they do not comply with the regulation.[31] It is intended that GDPR will force organizations to understand their data privacy risks and take the appropriate measures to reduce the risk of unauthorized disclosure of consumers’ private information. [32]

### International standards

The international standards ISO/IEC 27001:2013 and ISO/IEC 27002:2013 cover data security under the topic of information security, and one of its cardinal principles is that all stored information, i.e. data, should be owned so that it is clear whose responsibility it is to protect and control access to that data.[33][34] The following are examples of organizations that help strengthen and standardize computing security:

The Trusted Computing Group is an organization that helps standardize computing security technologies.

The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary international information security standard for organizations that handle cardholder information for the major debit, credit, prepaid, e-purse, automated teller machines, and point of sale cards.[35]

The General Data Protection Regulation (GDPR) proposed by the European Commission will strengthen and unify data protection for individuals within the EU, whilst addressing the export of personal data outside the EU.

## Safeguards

The four types of technical safeguards are access controls, flow controls, inference controls, and data encryption. Access controls manage user entry and data manipulation, while flow controls regulate data dissemination. Inference controls prevent deduction of confidential information from statistical databases and data encryption prevents unauthorized access to confidential information.[36] Health Insurance Portability and Accountability Act (HIPPA) is a law that requires entities such as healthcare providers to keep patient confidentiality for three required safeguards: administrative, physical, and technical.[37]

## See also

* Copy protection
* Cyber-security regulation
* Data-centric security
* Data erasure
* Data masking
* Data recovery
* Digital inheritance
* Disk encryption
* Comparison of disk encryption software
* Identity-based security
* Information security
* IT network assurance
* Pre-boot authentication
* Privacy engineering
* Privacy law
* Raz-Lee
* Security breach notification laws
* Single sign-on
* Smart card
* Tokenization
* Transparent data encryption
* USB flash drive security
* Gordon–Loeb model for cyber security investments

## References

1. ↑ Summers, G. (2004). Data and databases. In: Koehne, H Developing Databases with Access: Nelson Australia Pty Limited. p4-5.
2. ↑ "Knowing Your Data to Protect Your Data" (in en-US). 2017-09-25. https://www.itbusinessedge.com/it-management/knowing-your-data-to-protect-your-data/.
3. ↑ "Data Security: Definition, Importance, and Types" (in en). https://www.fortinet.com/resources/cyberglossary/data-security.
4. ↑ "Home - International Journal Of Engineering And Advanced Technology (IJEAT)" (in en-US). https://www.ijeat.org/.
5. ↑ Mohammed, Noor Sabah; Dawood, Omar Abdulrahman; Sagheer, Ali Makki; Nafea, Ahmed Adil (2024-01-01). "Secure Smart Contract Based on Blockchain to Prevent the Non-Repudiation Phenomenon" (in en). مجلة بغداد للعلوم 21 (1). doi:10.21123/bsj.2023.8164. ISSN 2078-8665. https://bsj.uobaghdad.edu.iq/index.php/BSJ/article/view/8164.
6. ↑ Rupp, Eduard; Syrmoudis, Emmanuel; Grossklags, Jens (2022). "Leave No Data Behind – Empirical Insights into Data Erasure from Online Services". Proceedings on Privacy Enhancing Technologies (3): 437–455. doi:10.56553/popets-2022-0080. ISSN 2299-0984. https://petsymposium.org/popets/2022/popets-2022-0080.php.
7. ↑ Bars, Nils; Bernhard, Lukas; Schloegel, Moritz; Holz, Thorsten (2025-09-10), "Empirical Security Analysis of Software-based Fault Isolation through Controlled Fault Injection", Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pp. 2639–2652, doi:10.1145/3719027.3765027, ISBN 979-8-4007-1525-9
8. ↑ Thanh, Do van; Jorstad, Ivar; Jonvik, Tore; Thuan, Do van (2009). "Strong authentication with mobile phone as security token". 2009 IEEE 6th International Conference on Mobile Adhoc and Sensor Systems. pp. 777–782. doi:10.1109/MOBHOC.2009.5336918. ISBN 978-1-4244-5114-2.
9. ↑ Stubbs, Rob (Sep 10, 2019). "Why the World is Moving to Hardware-Based Security". Fortanix. https://www.fortanix.com/blog/2019/09/why-the-world-is-moving-to-hardware-based-security.
10. ↑ Chatterjee, Durba; Maitra, Shuvodip; Mishra, Nimish; Shukla, Shubhi; Mukhopadhyay, Debdeep (September 2025). "Hardware Security in the Connected World" (in en). WIREs Data Mining and Knowledge Discovery 15 (3). doi:10.1002/widm.70034. ISSN 1942-4787.
11. ↑ Waksman, Adam; Sethumadhavan, Simha (2011), "Silencing Hardware Backdoors", Proceedings of the IEEE Symposium on Security and Privacy (Oakland, California), https://www.cs.columbia.edu/~simha/preprint_oakland11.pdf
12. ↑ "What is Backup and Recovery? | Learn Data Backup Solutions" (in en). https://www.cohesity.com/glossary/backup-and-recovery/.
13. ↑ "Back-ups | Stay Smart Online". https://www.staysmartonline.gov.au/Protect-yourself/Doing-things-safely/backups.
14. ↑ "What is Backup and Recovery? | Learn Data Backup Solutions" (in en). https://www.cohesity.com/glossary/backup-and-recovery/.
15. ↑ Jackson, Kevin (2024-04-08). "Incremental vs. Differential Backup: Balancing Speed and Storage" (in en-US). https://trilio.io/resources/incremental-vs-differential-backup/.
16. ↑ "What Is Data Privacy? Definition & Protection | Proofpoint US" (in en-us). 2021-06-29. https://www.proofpoint.com/us/threat-reference/data-privacy.
17. ↑ "Data Privacy and Security: How to Safeguard Information in the Digital Age | Ironhack Blog" (in en). https://www.ironhack.com/gb/blog/data-privacy-and-security-safeguarding-information-in-the-digital-age.
18. ↑ "Data Masking Definition". http://mask-me.net/datamaskingwiki/wiki/26/data-masking-definition.
19. ↑ "data masking". http://searchsecurity.techtarget.com/definition/data-masking.
20. ↑ "Data Security: Definition, Importance, and Types" (in en). https://www.fortinet.com/resources/cyberglossary/data-security.
21. ↑ FAST'11: Proceedings of the 9th USENIX conference on File and storage technologies , Wikidata Q115346857
22. ↑ Rupp, Eduard; Syrmoudis, Emmanuel; Grossklags, Jens (2022). "Leave No Data Behind – Empirical Insights into Data Erasure from Online Services". Proceedings on Privacy Enhancing Technologies (3): 437–455. doi:10.56553/popets-2022-0080. ISSN 2299-0984. https://petsymposium.org/popets/2022/popets-2022-0080.php.
23. ↑ Babulak, Eduard, ed (2023) (in English). Malware : Detection and Defense. IntechOpen. doi:10.5772/intechopen.105262. ISBN 978-1-83768-444-1. https://directory.doabooks.org/handle/20.500.12854/113227.
24. ↑ "Procedia Computer Science | Journal | ScienceDirect.com by Elsevier" (in en-us). https://www.sciencedirect.com/journal/procedia-computer-science.
25. ↑ Sharmeen, Shaila; Huda, Shamsul; Abawajy, Jemal H.; Ismail, Walaa Nagy; Hassan, Mohammad Mehedi (2018). "Malware Threats and Detection for Industrial Mobile-IoT Networks". IEEE Access 6: 15941–15957. doi:10.1109/ACCESS.2018.2815660. ISSN 2169-3536. Bibcode: 2018IEEEA...615941S.
26. ↑ Zhang, Penghui; Oest, Adam; Cho, Haehyun; Sun, Zhibo; Johnson, RC; Wardman, Brad; Sarker, Shaown; Kapravelos, Alexandros et al. (May 2021). "CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing". 2021 IEEE Symposium on Security and Privacy (SP). pp. 1109–1124. doi:10.1109/SP40001.2021.00021. ISBN 978-1-7281-8934-5.
27. ↑ "What Is Phishing: Understand Cyber Threats and Prevention | ACC Newsroom | Austin Community College District" (in en-US). 2025-10-16. https://sites.austincc.edu/newsroom/2025/10/16/what-is-phishing-understand-cyber-threats-and-prevention/.
28. ↑ Lee, Jaeil; Lee, Yongjoon; Lee, Donghwan; Kwon, Hyukjin; Shin, Dongkyoo (2021). "Classification of Attack Types and Analysis of Attack Methods for Profiling Phishing Mail Attack Groups". IEEE Access 9: 80866–80872. doi:10.1109/ACCESS.2021.3084897. ISSN 2169-3536. Bibcode: 2021IEEEA...980866L.
29. ↑ "data protection act". https://ico.org.uk/for-organisations/guide-to-data-protection/principle-1-fair-and-lawful/.
30. ↑ Peter Fleischer, Jane Horvath, Shuman Ghosemajumder (2008). "Celebrating data privacy". Google Blog. http://googleblog.blogspot.com/2008/01/celebrating-data-privacy.html.
31. ↑ "GDPR Penalties". https://www.itgovernance.co.uk/dpa-and-gdpr-penalties.
32. ↑ "Detect and Protect for Digital Transformation". https://www.informatica.com/products/data-security.html#fbid=UIV8MkPprTe.
33. ↑ "ISO/IEC 27001:2013" (in en). 16 December 2020. https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/05/45/54534.html.
34. ↑ "ISO/IEC 27002:2013" (in en). 15 April 2021. https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/05/45/54533.html.
35. ↑ "PCI DSS Definition". https://www.pcmag.com/encyclopedia/term/59104/pci-dss.
36. ↑ Denning, Dorothy E., and Peter J. Denning. "Data security." ACM computing surveys (CSUR) 11.3 (1979): 227-249.
37. ↑ Security, Stephen Cavey Blog Post Cybersecurity Data. "Three Safeguards You Need For the HIPAA Security Rule | Ground Labs" (in en). https://www.groundlabs.com/blog/what-is-the-hipaa-security-rule-three-safeguards-to-have-in-place.

## External links

* Getting Ready for New Data Laws \- Local Gov Magazine
* EU General Data Protection Regulation (GDPR)
* Countering ransomware attacks

* v
* t
* e

Data

* Analysis
* Archaeology
* Cleansing
* Collection
* Compression
* Corruption
* Curation
* Degradation
* Editing
* ETL
* Farming
* Format management
* Fusion
* Integration
* Integrity
* Library
* Loss
* Management
* Migration
* Mining
* Pre-processing
* Preservation
* Protection (privacy)
* Recovery
* Reduction
* Retention
* Quality
* Science
* Scraping
* Scrubbing
* Security
* Stewardship
* Storage
* Validation
* Warehouse
* Wrangling/munging

* v
* t
* e

Privacy

Principles|

* Expectation of privacy
* Right to privacy
* Right to be forgotten
* Post-mortem privacy

Privacy laws|

* Australia
* Canada
* Denmark
* England
* European Union
* Germany
* Ghana
* New Zealand
* Singapore
* Switzerland
* United States

Data protection authorities|

* Australia
* Denmark
* European Union
* France
* Germany
* Ireland
* Isle of Man
* Norway
* Philippines
* Spain
* Sweden
* Switzerland
* Thailand
* United Kingdom

Areas|

* Consumer
* Marital
* Medical
* Workplace

Information privacy|

* Law
* Financial
* Internet
* Personal data
* Personal identifier
* Privacy-enhancing technologies
* Social networking services
* Privacy engineering
* Secret ballot

Advocacy organizations|

* American Civil Liberties Union
* Center for Democracy and Technology
* Computer Professionals for Social Responsibility
* Future of Privacy Forum
* Electronic Privacy Information Center
* Electronic Frontier Foundation
* European Digital Rights
* Global Network Initiative
* NOYB
* Privacy International
* Privacy Rights Clearinghouse

See also|

* Anonymity
* Cellphone surveillance
* Cyberstalking
* Data security
* Global surveillance
* Mass surveillance
* Privacy engineering
* Human rights
* Identity theft
* Panopticon
* Personality rights
* Search warrant

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Data security. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Data_security&oldid=4229970"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template