The Information Protection Life Cycle and Framework: Secure

The Information Protection Life Cycle (IPLC) frames how information should be protected across three stages: acquire & assess, active use life, and disposition. The focus here is the “Secure” control category within the Active Use Life stage, emphasizing that protecting information assets must go beyond basic access control and instead implement confidentiality, integrity, and availability (CIA). Confidentiality depends not only on authorizing users but also ensuring the devices and applications handling sensitive information are hardened. Integrity requires preventing unauthorized tampering or modification. Availability requires keeping information ready for use, recognizing that DDoS and bot attacks commonly target availability.

Three primary techniques are highlighted for improving confidentiality and integrity: encryption, tokenization, and data masking. Encryption encodes data so it is unreadable without keys, and should be applied both at rest and in transit. While Unified Endpoint Management (UEM) can enforce whole-disk encryption, this is portrayed mainly as a compliance-oriented “last resort” for lost or stolen devices, offering limited protection against many other cyber risks. More effective approaches encrypt logical data elements and integrate centralized key management, policy controls, auditing, and connectors across systems. Strong integration with IAM is needed so encryption requirements can be driven by data classification, ownership, group membership, and user attributes.

Tokenization replaces sensitive values with random placeholders while keeping the real data in a secure external platform, reducing compliance scope and supporting format-preserving behavior for existing applications. Masking is described as an irreversible variant that keeps data realistic; static masking permanently desensitizes copied/exported datasets, while dynamic masking alters results at retrieval time so only authorized users see original values. Recommendations stress modern encrypted protocols (TLS 1.3, SSH/SFTP, HTTPS), avoiding proprietary cryptography, strengthening key management (including HSMs), considering secure enclaves for data-in-use, and using risk-based roadmaps to close capability gaps.

• The IPLC defines three stages: acquire & assess, active use life, and disposition.
• Active Use Life is borrowed from archaeology as the period when a human-made artifact is actively in use.
• The Secure control category emphasizes confidentiality, integrity, and availability (CIA).
• DDoS and bot attacks are intended to make information unavailable.
• Encryption should be used for data at rest and data in transit.
• UEM solutions often include the ability to enforce disk-level encryption for managed endpoints.
• Traditional web-era protocols such as FTP, Telnet, DNS, and HTTP were originally unencrypted.
• TLS 1.3 is stated as the current standard for encrypted data transfers over networks.
• Tokenization replaces sensitive values with randomly generated placeholders while storing the real data in an offsite tokenization platform.
• Dynamic masking can be combined with fine-grained access control so authorized users see original data while others see masked results.

• “Securing information requires asset owners to go above and beyond access control.”
• “Proper security necessitates consideration and implementation of the principles of confidentiality, integrity, and availability (CIA).”
• “It is impossible to guarantee confidentiality if unhardened devices and applications are used to process and display sensitive information.”
• “Whole disk encryption is the protection of last resort when laptops and mobile devices are stolen, preventing thieves from getting access to information stored on those lost devices.”
• “Unfortunately, they do not protect against the majority of other cyber-risks and should be considered rather a compliance measure than a proper security control.”
• “Administrators should be able to require encryption not only according to data classification, but also based on information owners and users.”
• “All organizations should make replacing these with their newer encrypted counterparts such as SFTP, SSH, DNSSec, HTTPS (using TLS) a top priority.”
• “Proprietary encryption methods should be avoided.”
• “Tokenization is the process of replacing sensitive values with randomly generated placeholders, while the real data is stored securely in an offsite tokenization platform and never leaves (or enters) your internal systems, thus reducing the scope of regulatory compliance.”
• “Masking ensures that the data still looks realistic and the functionality of applications expecting values in certain formats is not affected.”