Data-Centric Security

Data-centric security focuses on protecting data regardless of its location — at rest, in transit, or in use. It begins with understanding what data exists and ends with controls that follow data wherever it goes.

Data discovery and classification

You cannot protect what you cannot see. Discovery is the foundation.

Classification tiers

A typical four-tier classification scheme:

Tier	Label	Description	Example
1	Public	No harm if disclosed	Marketing materials
2	Internal	Limited to employees	Internal policies
3	Confidential	Business harm if disclosed	Financial projections, PII
4	Restricted	Serious harm if disclosed	Payment data, health records, IP

Discovery tooling

Microsoft Purview (formerly AIP) — auto-classifies Office 365 content
Varonis — discovers and classifies unstructured data on file shares and cloud storage
Macie (AWS) — discovers and classifies sensitive data in S3
BigID — multi-cloud data discovery and classification

Encryption at rest

All data classified Confidential or above must be encrypted at rest.

Key management

Encryption is only as strong as the key management:

Hardware Security Modules (HSMs) — keys never leave hardware
AWS KMS / Azure Key Vault / GCP Cloud KMS — managed key storage; customer-managed keys (CMK) for sensitive data
Key rotation — rotate encryption keys annually (or more frequently for high-sensitivity data)
Key separation — encryption keys and encrypted data must not be stored together

Storage encryption

Full-disk encryption — BitLocker (Windows), LUKS (Linux), FileVault (macOS)
Database TDE — Transparent Data Encryption on MSSQL, Oracle, MySQL, PostgreSQL
Object storage — SSE-S3 / SSE-KMS (AWS), CMEK (GCP), SSE with Azure Key Vault
Backup encryption — encrypted backups with keys stored separately from backup media

Data Loss Prevention (DLP)

DLP controls detect and prevent the unauthorised exfiltration of sensitive data.

DLP inspection points

Channel	DLP control
Email	Email gateway DLP (Proofpoint, Mimecast, M365 Purview DLP)
Web (HTTP/S)	Proxy-based DLP; content inspection on POST requests
Cloud storage	CASB DLP (Netskope, Zscaler, Microsoft Defender for Cloud Apps)
Endpoint	Endpoint DLP agent (Microsoft Purview, Symantec DLP, Forcepoint)
Printing/USB	Endpoint DLP — block or log print/removable media

DLP policy design

Start with monitoring mode — understand normal patterns before blocking
Focus first on Restricted / PCI / HIPAA data — high-impact, well-defined patterns
Use exact data matching (EDM) for structured data (credit card numbers, NHS numbers)
Use document fingerprinting for unstructured data (contract templates, source code)
Review false positives weekly in the initial deployment phase

Data residency and sovereignty

For regulated industries and public sector:

Identify where data is stored (region/country)
Enforce storage restrictions via cloud organisation policies (AWS SCPs, Azure Policy, GCP Org Policy)
Audit data residency quarterly — cloud misconfigurations can move data unexpectedly

Data-Centric Security ​

Data discovery and classification ​

Classification tiers ​

Discovery tooling ​

Encryption at rest ​

Key management ​

Storage encryption ​

Data Loss Prevention (DLP) ​

DLP inspection points ​

DLP policy design ​

Data residency and sovereignty ​

Further reading ​