Which of the following best protects sensitive data in transit across a geographically dispersed Infrastructure?

Encryption is the most direct and robust method for protecting sensitive data while it is

being transmitted across a network, such as a geographically dispersed infrastructure.

Cryptographic protocols like Transport Layer Security (TLS), IPsec, or Secure Shell

(SSH) are specifically designed to create secure, encrypted channels.

These protocols transform the original sensitive data (plaintext) into an unreadable

format (ciphertext) during transit, ensuring that if the data is intercepted, it remains

confidential and unintelligible to unauthorized parties. This directly addresses the

protection of the sensitive data itself as it moves.

B. Masking: This technique is primarily used to create inauthentic versions of data for

non-production environments like testing or development by altering or obscuring

specific parts of the data. It's not a primary method for protecting live, original sensitive

data in transit.

C. Tokenization: Tokenization replaces sensitive data with a unique, non-sensitive

identifier (a token). The actual sensitive data is stored securely elsewhere. While this is

an effective security measure, it protects sensitive data by preventing its transit, rather

than protecting it during transit.

D. Obfuscation: This is a general term for making data unclear or difficult to understand.

Encryption is a strong, specific form of obfuscation. However, "obfuscation" itself isn't a

precise protection mechanism and can include weaker methods. "Encryption" is the more

accurate and specific term for robustly protecting data confidentiality in transit.

NIST Special Publication 800-57 Part 1 Revision 5: "Recommendation for Key

Management"

URL: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final

Section: 2.2.3 Protection of Data in Transit (Page 16)

Supporting Quote: "Data that is being transmitted across a network may be protected

by applying cryptographic protection to the data (e.g., by using a trusted, validated

cryptographic module) before transmission... Common protocols that provide

cryptographic protection for data in transit include Transport Layer Security (TLS),

Secure Shell (SSH), Internet Protocol Security (IPsec)..."

AWS Well-Architected Framework - Security Pillar: "Protect data in transit"

URL: https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/protect-data- in-

transit.html

Section: "Protect data in transit"

Supporting Quote: "Encrypt all sensitive data in transit. Enforce encryption using

protocols such as Transport Layer Security (TLS) or IPsec... For network traffic, use

protocols that encrypt, such as TLS, IPsec (for example, a VPN connection), or SSH."

Microsoft Azure Documentation: "Azure encryption overview - Encryption of data in

transit"

URL: https://learn.microsoft.com/en-us/azure/security/fundamentals/encryptionoverview#encryption-of-data-in-transit

Section: "Encryption of data in transit"

Supporting Quote: "Data is in transit or in flight when it's being transferred between

components, locations, or programs... Azure provides many mechanisms for keeping

data private as it moves from one location to another... Examples include use of

TLS/SSL, IPsec, and HTTPS."

NIST Special Publication 800-122: "Guide to Protecting the Confidentiality of

Personally Identifiable Information (PII)" (For Masking context)

URL: https://csrc.nist.gov/publications/detail/sp/800-122/final

Section: Appendix D.2 De-identification (Page D-1)

Supporting Context for Masking: "De-identification techniques include... data masking

(i.e., transforming data to hide original content...)"

NIST Internal Report (NISTIR) 8053: "De-Identification of Personal Information" (For

Tokenization context)

URL: https://csrc.nist.gov/publications/detail/nistir/8053/final

Section: 3. Basic De-Identification Concepts (Page 12)

Supporting Context for Tokenization: "Tokenization is the process of replacing a

sensitive data element with a non-sensitive substitute, referred to as a token."

NIST Glossary: "Obfuscation" and "Encryption"

URL (Obfuscation): https://csrc.nist.gov/glossary/term/obfuscation

URL (Encryption): https://csrc.nist.gov/glossary/term/encryption

Supporting Context: These definitions highlight encryption as a specific cryptographic

process, while obfuscation is a broader term for making something unclear.