An IoT gateway will be brokering data on numerous northbound and southbound interfaces. A security practitioner has the data encrypted while stored on the gateway and encrypted while transmitted across the network. Should this person be concerned with privacy while the data is in use?

Data security is typically categorized into three states: data in motion (during transmission), data at rest (in storage), and data in use (during processing). The scenario describes protections for the first two states using encryption. However, for a standard CPU to perform computations, data must be decrypted and loaded into system memory (RAM). While in this "in use" state, the unencrypted, plaintext data is vulnerable to memory-scraping malware, unauthorized privileged access, or side-channel attacks that can read the contents of RAM. Therefore, even with robust encryption for data at rest and in motion, a significant privacy risk remains during the processing phase.

A. Hashing is a cryptographic function used to ensure data integrity (that data has not been altered), not confidentiality or privacy. The question is about privacy.
C. This is incorrect because it ignores the third state of data. Securing data at rest and in motion does not automatically secure it while it is being actively processed.
D. This assumes the universal presence of advanced technologies like secure enclaves (e.g., Intel SGX, AMD SEV). Such confidential computing features are not standard on all IoT hardware. ---

1. Microsoft Azure Documentation, "Confidential computing overview." Microsoft Corporation, 2023. In the section "The problem: Data in use is vulnerable," it states, "Before confidential computing, any data in use was typically unencrypted and vulnerable... For data to be processed, it must be in memory. This leaves data in memory vulnerable to attacks..." This official vendor documentation confirms that data is vulnerable during processing, supporting the correct answer.

2. Intel Corporation, "Intel® Software Guard Extensions (Intel® SGX) For Dummies®." John Wiley & Sons, Inc., 2021. Chapter 1, "Understanding the Need for Better Security," p. 8. The document explains, "Data is encrypted when it’s at rest... and in transit... But when data is in use, it’s decrypted and in the clear. This state is when data is most vulnerable." This supports the reasoning that data in use is a critical point of vulnerability and refutes the assumption in option D.

3. David, E., & Riley, L. (2021). Computer Security: A Hands-on Approach (3rd ed.). Chapter 12, "Memory Forensics." This university-level textbook details methods, such as memory acquisition and analysis, that can be used to extract sensitive data (like passwords and encryption keys) directly from a system's RAM, demonstrating the tangible risks to data "in use."