Cybersecurity area
Data Security
Data Security protects sensitive data during use, transfer, storage, sharing, and processing across local, cloud, SaaS, and AI scenarios.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- DLP
- Data Loss PreventionDetection and control of sensitive data movement to prevent accidental or unauthorized leakage.
- HSM
- Hardware Security ModuleSpecialized hardware for secure generation, storage, and use of cryptographic keys.
What This Area Covers
Data Security focuses on protecting data wherever it resides: endpoints, servers, databases, cloud, SaaS applications, AI tools, transmission channels, or shared documents. The foundation is knowing which data is sensitive, who can access it, and how it is used.
Why It Matters
Data leakage can result from an attack, user mistake, incorrect sharing, lost device, weak key management, or uncontrolled use of data in AI and analytics. Data Security therefore consists of several layers: classification, DLP, encryption, key management, HSM, tokenization, and data masking. Each layer protects a different part of the data lifecycle.
How To Navigate This Area
Data protection begins with understanding where sensitive data is located, who works with it, which applications and AI tools it enters, and which rules apply to it. The right combination of classification, DLP, encryption, key management, tokenization, masking, and access controls can then be selected.
Technology selection should start with data type, regulation, and usage model. Protecting documents is different from encrypting disks, tokenizing payment data, masking test data, or managing keys in a hybrid cloud. Protection must be technically strong and usable for everyday users.
The technology list below works as a map of the Data Security area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which data is most sensitive and where is it located?
- Is the priority leakage prevention, encryption, classification, or anonymization?
- Does sensitive data enter SaaS applications, collaboration tools, or AI services?
- How will policies apply across email, cloud, endpoints, and applications?
- Who manages cryptographic keys and how is their use audited?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- BOLA – Broken Object Level AuthorizationAn adversary changes an object identifier in an API request and gains access to data or operations belonging to another user, account, or tenant.
- BOPLA – Broken Object Property Level AuthorizationAn API exposes or allows modification of sensitive object properties that the user should not access, including excessive data exposure and mass assignment.
- Path traversal and file inclusionAn adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
Relevant ATT&CK techniques
- T1005 · Data from Local SystemDetect, Prevent, Recover, Respond
- T1020 · Automated ExfiltrationDetect, Prevent, Respond
- T1041 · Exfiltration Over C2 ChannelDetect, Prevent, Respond
- T1048 · Exfiltration Over Alternative ProtocolDetect, Prevent, Respond
- T1114 · Email CollectionDetect, Prevent, Respond
- T1213 · Data from Information RepositoriesDetect, Prevent, Recover, Respond
- T1530 · Data from Cloud StorageDetect, Prevent, Recover, Respond
- T1565 · Data ManipulationPrevent, Recover
- T1567 · Exfiltration Over Web ServiceDetect, Prevent, Respond
- T1600 · Weaken EncryptionPrevent, Recover