Protecting Data — Concept Reference

Technique	Reversible?	Key Required?	Primary Goal	Where Original Lives	Exam Trigger Words
Encryption	Yes — two-way; requires key to reverse	Yes — algorithm + key	Confidentiality (data at rest, in transit)	Encrypted wherever stored; plaintext only when decrypted with key	"requires a key to decrypt," "two-way," "ciphertext," "AES," "plaintext"
Hashing	No — one-way; mathematically irreversible	No — deterministic function	Integrity verification; password storage	Only the hash is stored; original cannot be recovered from hash	"one-way," "message digest," "fingerprint," "SHA-256," "cannot recover original"
Tokenization	Yes — but only via token service lookup	No key — lookup table in token service	Replace sensitive value in systems; minimize exposure	Only in token service (secure lookup); systems hold only the token	"token," "no mathematical relationship," "mobile payment," "Apple Pay," "replace card number"
Masking	Partially — hides for display; original may still be stored	No	Restrict what users see; reduce exposure in UI	Original often still in database; masking is a view-layer control	"last four digits," "**** ****," "hide part of data," "call center sees masked number"
Obfuscation	Yes — with effort; no key required by analyst	No	Make code/data hard to understand; IP protection; evasion	Obfuscated version exists; original can be reconstructed with analysis	"code hard to read," "same functionality," "minified," "malware evasion," "not encryption"
Segmentation	N/A — architecture approach, not transformation	N/A	Limit breach blast radius; tiered security	Data distributed across multiple databases/systems	"distribute data," "separate databases," "limit breach scope," "tiered security"
Permission Restrictions	N/A — access control approach	N/A — credentials, not keys	Authentication + post-login authorization	Data protected by who can access, not transformation of data itself	"least privilege," "MFA," "groups," "separation of duties," "password policy"
Geofencing	N/A — access control approach	N/A	Location-based access control	Data protected by where access is attempted from	"inside building," "location-based," "country block," "impossible travel," "GPS"

Property	Encryption	Hashing	Tokenization
Direction	Two-way (encrypt and decrypt)	One-way only (cannot reverse)	Two-way via lookup — but no math to reverse it
Key involved?	Yes — algorithm + key; key protects the transform	No — deterministic function; same algorithm always gives same result	No key — lookup table in token service maps token ↔ original
Mathematical relationship between input and output?	Yes — decryption algorithm undoes encryption given the key	Yes — hash function is deterministic; same input always same output	No — token is an arbitrary substitute; no math connects token to original
Can you recover the original?	Yes — with the correct key	No — the hash cannot be reversed; only matching can be done	Yes — but only by querying the token service; mathematically impossible without it
Output format	Ciphertext (variable length; usually binary or base64)	Fixed-length digest (SHA-256: always 64 hex chars)	Token (can be same format as original — same length SSN, same format card number)
Primary use cases	Protecting confidential data at rest and in transit; files, disk, database, messages	Password storage; file integrity verification; digital signatures	Payment card numbers (PCI DSS); SSNs; anywhere sensitive values transit multiple systems
Overhead	Cryptographic computation on every encrypt/decrypt operation	Cryptographic computation on every hash operation	Minimal crypto — primarily a database lookup for mapping
If stolen from storage	Attacker has ciphertext — useless without key	Attacker has hash — can only crack via dictionary/brute force	Attacker has token — mathematically useless; cannot reverse without token service

Aspect	Data Masking	Tokenization
What it does to original value	Hides part of the value for display; original may still exist in storage unchanged	Replaces the entire value with a substitute token; original moved to secure token vault only
Where original data lives	Still in the database (usually); masking is applied at the presentation layer	Only in the token service / token vault; the token is the only thing in transactional systems
Example	Credit card **** **** **** 4532 displayed in UI; full number 4111-1111-1111-1532 still in database	SSN 266-12-1112 replaced by token 691-61-8539 everywhere; 266-12-1112 only in token vault
If database is breached	Full original value may still be exposed — masking protects the UI view, not the stored record	Attacker gets only tokens — mathematically useless; token vault (separate, highly secured system) not compromised in typical database breach
Does it eliminate sensitive data from the system?	No — data may still be present; only the view is controlled	Yes — the sensitive value is removed from transactional systems; only the token exists there
Best for	Display restrictions: call center agents see enough to identify a card without seeing the full number; reports showing partial data	Systems that need to reference a sensitive value by ID without needing the actual value: merchant systems, PCI DSS scope reduction
PCI DSS scope reduction	No — the full card number is still in scope because it exists in storage	Yes — tokenized systems may be removed from PCI DSS scope; the card number no longer exists in merchant systems

Use Case	How Hashing Is Applied	What It Proves	Algorithm Used
Password storage	Hash the password on registration; store the hash. On login: hash the entered password; compare to stored hash. Match = correct password.	User knows the correct password — without the system ever storing or transmitting the actual password	bcrypt, Argon2, PBKDF2 (not raw SHA-256 — these add salting and work factor); SHA-256 sometimes used but less ideal without salting
File integrity verification	Publisher computes hash of legitimate file and publishes it. User downloads file, computes hash, compares to published hash. Match = file not tampered.	The file received is identical to the file the publisher signed — no bytes changed in transit or at rest	SHA-256 (most common), SHA-512; MD5 sometimes still used for non-security checksums despite deprecation
Digital signatures	Sender hashes message → encrypts hash with private key = signature. Receiver decrypts signature with public key → gets hash; independently hashes message; compares.	Authentication (only key holder could sign) + Integrity (any change → hash mismatch) + Non-repudiation (sender cannot deny)	SHA-256 in RSA-PKCS1v15, ECDSA, or EdDSA signatures; SHA-1 deprecated for signatures
Message authentication codes (HMACs)	Hash computed with a shared secret key mixed in. Recipient with the same key verifies the hash.	The message was created by someone with the shared key and has not been altered	HMAC-SHA256 (most common); HMAC-SHA512
Blockchain / ledger integrity	Each block contains the hash of the previous block. Any alteration to a historical block changes its hash, invalidating all subsequent blocks.	The chain of records has not been tampered with since each block was added	SHA-256 (Bitcoin), Keccak-256 (Ethereum)

Technology	How It Works	Accuracy	Works Indoors?	Spoofable?	Best For
GPS (Global Positioning System)	Device receives signals from satellite constellation; calculates position by time-of-flight triangulation	Meters — highly accurate outdoors	Poor — satellites not visible inside buildings	Yes — GPS spoofing hardware exists; significant effort required	Mobile device geofencing; vehicle tracking; high-accuracy outdoor positioning
802.11 Wi-Fi Positioning	Device scans for visible Wi-Fi access points; maps to known AP locations from survey database; calculates position	Meters to tens of meters — building-level accuracy	Yes — works anywhere Wi-Fi APs are visible	Harder than IP — requires knowledge of AP locations	Building-level access control ("inside corporate building"); indoor positioning; campus security
Cell Tower Triangulation	Device signal triangulated from multiple cell towers; position estimated based on signal strength and timing	Hundreds of meters in urban areas; kilometers in rural areas	Partial — depends on building penetration of cell signals	Theoretically possible; uncommon in practice	General mobile device location; country/region determination; wide-area tracking
IP Address Geolocation	IP address mapped to geographic region via ISP registration and geolocation databases (MaxMind, IP2Location)	City level at best; unreliable for specific building or address	Yes — works whenever IP address is known	Yes — VPNs and proxies easily change apparent location	Country-level access restriction; rough geographic filtering; less accurate use cases

Requirement / Scenario	Best Technique	Why
Store passwords in a database — users must be able to authenticate but passwords must not be recoverable	Hashing (with salt and work factor)	One-way: system can verify entered password by hashing and comparing; cannot recover original. Encryption not appropriate — requires key management, and decryption is unnecessary since only verification is needed.
Protect a credit card number so that payment systems never hold the real card number — reduce PCI DSS scope	Tokenization	Replaces real card number with a token everywhere in merchant systems; real number only in token vault. Masking would not help — the real number would still be stored. Encryption would still require the merchant to handle the decryption key, keeping them in PCI scope.
Call center agent should be able to identify which credit card a customer is asking about without seeing the full number	Data masking	Show only last 4 digits; agent can identify the card; the full number remains in the backend for payment processing. Tokenization is also possible here but masking is the simpler, more targeted solution for this display restriction use case.
Verify that a downloaded software package has not been tampered with	Hashing (integrity verification)	Publisher publishes SHA-256 hash of the legitimate file; user computes hash of downloaded file; match confirms integrity. Encryption would be over-engineered — no confidentiality needed; only integrity verification.
Protect the contents of a file so that unauthorized parties who access the storage cannot read it	Encryption	Two-way encryption protects the content; authorized parties with the key decrypt and read. Hashing would not work — it is one-way and the content cannot be recovered. Masking only applies to display, not storage.
Distribute sensitive data across multiple systems to limit the damage of any single breach	Data segmentation	Architectural control; putting all sensitive data in one database creates a single-point breach. Segmentation limits what an attacker gets from any one compromise.
Allow access to a building's most sensitive system only when users are physically inside the building	Geofencing (802.11 / network segment)	Location-based access control; 802.11 or network VLAN can confirm the user is on the corporate network inside the building. Permission restrictions control who can access; geofencing controls from where.
Make proprietary software difficult for a competitor to reverse-engineer after distribution	Obfuscation	Scrambles code structure while preserving function; legitimate IP protection. Not perfect — can be reversed with effort — but raises the cost of analysis. Encryption of the binary would prevent execution; obfuscation allows the code to run normally.