What is data in use?
Data in use is one of the three data states, alongside data at rest and data in transit. It describes data that an application or person is actively working with: a database record loaded into an application server's RAM, a spreadsheet open on a laptop, a card number while a payment is being authorized, or a private key held in memory by a web server. To be processed, data almost always has to be in plaintext, so the encryption that protected it on disk and on the network has already been removed by the time it reaches this state.
How data in use is attacked
- Memory scraping: malware reads another process's memory to catch values while they are briefly in the clear. The 2013 Target breach used point-of-sale malware that captured card data from terminal memory.
- Credential dumping: tools such as Mimikatz read password hashes and Kerberos tickets from the memory of the Windows LSASS process.
- Memory written to disk: crash dumps, page files and hibernation files can hold copies of whatever was in RAM.
- Privileged platforms: a compromised hypervisor, or an administrator at a cloud provider, can in principle inspect a guest's memory.
- Side channels: flaws such as Spectre and Meltdown, disclosed in 2018, let code infer data belonging to other processes from the way the CPU behaves.
Protecting data in use
Ordinary controls come first. Limit who holds debug privileges or can open another process's memory, run endpoint detection that flags access to sensitive processes, keep secrets in memory only as long as needed, and encrypt disks so page and hibernation files aren't readable on a stolen device. On Windows, Credential Guard uses virtualization-based security to move credential secrets out of reach of the normal operating system.
Hardware isolation goes further. A trusted execution environment (TEE) is an area of a processor whose memory is encrypted and isolated from the operating system and the hypervisor. Confidential computing runs workloads inside TEEs, such as Intel SGX enclaves, Intel TDX, AMD SEV-SNP and Arm CCA, and uses remote attestation so the data owner can verify what code is running before releasing keys to it. Homomorphic encryption, which computes on data that stays encrypted, exists but is too slow for most general workloads.
Example: detecting a memory read
A Sysmon process access event (Event ID 10) shows an unfamiliar program opening lsass.exe with access mask 0x1010, which includes the right to read the process's memory. That pattern is typical of credential-dumping tools, and it is an attack on data in use: the target is the set of secrets LSASS holds in memory for signed-in users, not a file on disk.
Data in use vs. at rest vs. in transit
| State | Where the data is | Main protections |
|---|---|---|
| At rest | Disks, backups, cloud storage | Full-disk, file and database encryption; permissions |
| In transit | Networks between systems | TLS 1.2 or later, IPsec, SSH |
| In use | RAM, CPU caches, application memory | Least privilege, EDR, Credential Guard, confidential computing |
Data in use on the CompTIA Security+ exam
Data states fall under SY0-801 objective 3.3, which covers how organizations understand and protect the data they hold. Wording such as "while it is being processed", "in RAM", "in memory" or "during computation" points to data in use. A requirement that even the cloud provider's administrators must not see data while a workload runs points to confidential computing or a secure enclave. Distractors include full-disk encryption and database encryption, which protect data at rest; TLS and VPNs, which protect data in transit; and tokenization, which changes what is stored rather than protecting values while they are processed.