Lesson 5 — Integrity, Encryption, Masking & Security Surfaces
Data integrity
In the security context, integrity means keeping data whole and protected from improper alteration, deletion, addition, or corruption.
Hashing vs encryption
Hash
A mathematical representation used as an integrity/verification clue. DMBOK names MD5 and SHA as examples. Fundamentals depth is recognizing the purpose, not doing cryptographic mathematics.
Private-key / symmetric encryption
The same secret key is used to encrypt and decrypt. The management challenge is protecting/sharing that key securely.
Public-key / asymmetric encryption
Different public/private keys are used. The public key can be distributed while the private key remains protected by its owner.
Hashing and encryption solve different questions: verification/integrity versus protecting readable content with keys.
Masking — not the same as encryption
Masking changes visible values so sensitive information is not exposed while enough structure or relationship can remain for legitimate use.
Persistent masking
Permanently and irreversibly alters the stored masked copy, often for non-production.
- In-flight persistent masking — transform while moving from source to destination; avoids leaving an unmasked target copy and can be rerun.
- In-place persistent masking — overwrite values where they already reside; useful in niche cleanup cases but riskier if the process fails partway.
Dynamic masking
Leaves the underlying source value intact and changes what a user sees based on access/entitlement.
Example: Production retains a full national ID, but most service users see only the last four digits → Dynamic masking.
Masking methods to recognize
Substitution, shuffling, temporal/date variance, numeric/value variance, nulling/deletion, randomization, encryption-based masking, expression masking, and key masking.
Key masking must preserve uniqueness and repeatability when relationships depend on the key.
Four practical exposure surfaces
- Facility security — physical access to locations holding systems/data.
- Device security — laptops, phones, removable storage, endpoints; loss, theft, malware, local storage, wipe/disposal.
- Credential security — IDs, passwords, identity lifecycle, stronger identification for sensitive access.
- Electronic communications — email, messaging, social channels; database protection does not protect data after a user sends an insecure export.
Exam discriminator
- permanently changed test copy → Persistent masking
- altered during source-to-test movement → In-flight persistent
- full Production truth remains, display changes → Dynamic masking
Source anchor: pp. 218–225.