A ticket arrives asking for a full copy of the customer database "so the new analytics contractor can get started." Before anyone runs the export, three questions need answers: what kind of data is in it, where the copy will sit and travel, and how much harm it would do in the wrong hands. Get any one of them wrong and the copy becomes the next breach report.
On the CompTIA Security+ SY0-801 exam this material sits under objective 3.3, which expects you to explain how organizations understand and protect the data they hold. This lesson covers the two data types, the three data states and the controls that fit each one, and the classification labels the exam uses, including how government and commercial schemes differ.
Structured data fits a schema, and unstructured data is everything else
Structured data follows a predefined model. Rows and columns in a relational database, fields in a CRM, and a CSV export with fixed headers are all structured. Every value has a known place and type: the card_number column holds 16 digits, the hire_date column holds a date. That predictability lets you protect structured data precisely. You can encrypt one column, mask one field for certain roles, give analysts a view that leaves out the salary column, and write DLP rules that look for a known pattern in a known place.
Unstructured data has no fixed model. Email bodies, Word documents, PDFs, chat messages, scanned forms, images, audio and video all fall here. By most estimates it makes up the large majority of what organizations store, and it's where sensitive data hides. A Social Security number is supposed to live in one database column, but over the years copies end up pasted into a support email, captured in a screenshot attached to a ticket, and typed into a spreadsheet on someone's desktop.
Unstructured data is harder to protect because you first have to find the sensitive content. Controls lean on discovery and inspection: DLP tools that scan file shares, mailboxes and cloud storage for patterns such as card numbers, sensitivity labels applied to documents, and tight file-system permissions.
Many texts add a third category, semi-structured data, for formats such as JSON, XML and log files that carry keys or tags but no rigid schema. The exam objective names only structured and unstructured, so treat semi-structured as background. On the exam, wording such as "table", "fields" or "records" points to structured data, while "documents", "email", "images" or "file shares" points to unstructured data. A scenario about locating sensitive data scattered across documents usually wants a discovery or DLP answer; one about protecting a single field in a database usually wants a field-level control.
Data at rest, in transit and in use each need their own controls
A data state describes what the data is doing at a given moment. The same customer record can be in all three states within a second: stored in a database file, sent across the network to an application server, and loaded into that server's memory so the application can work with it. Each state faces different threats, so each needs different controls.
| State | Where the data is | Example threat | Typical controls |
|---|---|---|---|
| At rest | Disks, SSDs, USB drives, tape, backups, cloud storage | Stolen laptop, copied backup, open storage bucket | Disk, file or database encryption; permissions; physical security |
| In transit | Moving across a LAN, Wi-Fi, the internet or between cloud regions | Eavesdropping, on-path attacks | TLS 1.2 or later, IPsec VPNs, SSH and SFTP |
| In use | RAM, CPU caches, an application's working memory | Memory scraping, a compromised OS or hypervisor | Least privilege, endpoint protection, secure enclaves, confidential computing |
Data at rest is stored somewhere. The classic threats are physical loss and unauthorized copying, so encryption at rest is the anchor control, backed by access controls that decide which accounts can read the files at all. The encryption levels for stored data, from full disk down to a single record, are covered in the encryption section.
Data in transit, sometimes called data in motion, is crossing a network. Anyone positioned on the path can try to read or alter it, which is why sensitive traffic should run over TLS 1.2 or later (TLS 1.3 preferred), IPsec or SSH on port 22. Wi-Fi encryption such as WPA3 helps, but it protects only the wireless hop between the device and the access point. Once traffic reaches the wired network it is protected only if the application or a VPN encrypts it end to end.