Topic
Data Security
What protects information once it leaves the systems you control, and how classification, keys, and cryptography divide the work.
78 posts
Data security is the practice of protecting information itself rather than the systems and networks that hold it, so protection survives copying, forwarding, and export. Data-centric security binds policy to the object, which turns every open into an access decision instead of trusting a single decision made at a boundary. Cryptographic enforcement makes that decision unavoidable: without a key release from the policy decision point (PDP), the bytes stay ciphertext.
Practitioners routinely confuse posture with enforcement. Discovery and classification tools report where sensitive data sits and who can reach it, but they do not stop an authorized user from forwarding a file. Data loss prevention inspects traffic at egress points it controls, so it has nothing to say about the copy that already left.
Posts under this hub separate what DLP, DRM, DSPM, and data-centric security each enforce, and cover classification, key custody, Merkle-tree lineage for provenance, post-quantum key encapsulation, and crypto agility. Regulatory posts address HIPAA, PCI DSS 4.0.1, DORA, and CMMC, and breach analyses trace which layer failed.
Frequently asked questions
What is data-centric security?
Data-centric security attaches protection and policy to the data object rather than to the network, device, or application around it. The object stays encrypted, and each attempt to open it triggers an authorization decision that releases a key or refuses one. Protection therefore persists after download, forwarding, or export, in environments the originating organization does not operate or monitor.
What is the difference between DLP, DRM, and DSPM?
Each enforces at a different point. Data loss prevention inspects content in motion at egress channels it controls and blocks matching transfers. Digital rights management controls what a rendering application permits after a file opens. Data security posture management discovers and reports where sensitive data lives and who has access, producing findings rather than enforcement decisions.
How do you protect data after it leaves your network?
Encrypt the object and keep the authorization decision separate from the file. When the encryption is bound to a policy, opening the file requires contacting a policy decision point that evaluates current attributes and either releases the key or refuses. Because the check happens at decrypt time, revocation and attribute changes take effect on copies already sitting on other people's disks.
Who should hold the keys in a data-centric architecture?
The data owner, through a key service the owner controls, separate from whoever stores the ciphertext. Splitting custody from storage means a cloud provider, hosting partner, or compromised repository holds bytes it cannot read. It also keeps revocation meaningful, since withdrawing key release stops future access regardless of how many copies exist elsewhere.
