Why Protecting Data Requires Controls for All Three Data States

Summary

The article explains how data-at-rest, in-transit, and in-use risks differ, and why protecting data requires layered controls such as encryption, access restrictions, secure transport, secure enclaves, and endpoint protection.

Key points

• Data at rest includes stored files, cloud data, and backups; suggested protections include encryption, access controls, and data loss prevention.
• Data in transit can face interception or tampering; the article recommends TLS, IPsec, SSH, SFTP, firewalls, and intrusion detection.
• Data in use is actively processed and may be readable in memory, where encryption at rest does not protect it.
• Suggested protections for data in use include memory protection, secure enclaves, application controls, and endpoint detection and response.
• The article advises identifying data’s current state and applying layered controls rather than relying on storage encryption alone.