Study guide
Section 11.2: Access Control & Encryption
DAMA Certified Data Management Professional CDMP
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Exam Overview & DMBoK Framework
1.1 CDMP Exam Details & Strategy 1.2 The DMBoK Framework 1.3 Data Management Organization & Roles
2 Chapter 2: Data Governance (Part A)
2.1 Data Governance Principles & Drivers 2.2 Operating Models & Structures 2.3 Policies, Standards, and Procedures
3 Chapter 2: Data Governance (Part B)
2.4 Data Stewardship 2.5 Governance Metrics & Implementation
4 Chapter 3: Data Modeling and Design (Part A)
Section 3.1: Conceptual, Logical, and Physical Models Section 3.2: ERD Notations & Relational Modeling Section 3.3: Normalization
5 Chapter 3: Data Modeling and Design (Part B)
3.4 Dimensional Modeling 3.5 Naming Standards & Modeling Best Practices
6 Chapter 4: Data Quality (Part A)
Section 4.1: Data Quality Dimensions Section 4.2: Data Quality Policy & Rules Section 4.3: DMAIC & DQ Improvement Lifecycle
7 Chapter 4: Data Quality (Part B)
4.4 Root-Cause Analysis & Remediation 4.5 DQ Metrics, Tools, and Reporting
8 Chapter 5: Metadata Management (Part A)
5.1 Business, Technical, and Operational Metadata 5.2 Metadata Lineage & Impact Analysis 5.3 Repository Architectures
9 Chapter 5: Metadata Management (Part B)
5.4 Standards and Semantics 5.5 Metadata Governance & Integration
10 Chapter 6: Master and Reference Data Management
6.1 Master vs Reference Data 6.2 MDM Repository Architectures 6.3 Match-Merge & Identity Resolution 6.4 Reference Data Governance & Standards
11 Chapter 7: Data Warehousing and Business Intelligence
7.1 DW Architectures: Inmon vs Kimball 7.2 Data Warehousing Storage & Load Patterns 7.3 BI Delivery & OLAP 7.4 Data Marts & Enterprise Data Warehouses
12 Chapter 8: Data Architecture
8.1 Enterprise Data Architecture & Zachman Framework 8.2 Data Flow Diagrams & Value Chains 8.3 Architecture Frameworks & Standards
13 Chapter 9: Document and Content Management
9.1 Records Management & ECM 9.2 Retention, Disposal, and E-Discovery 9.3 ARMA GARP Principles & Taxonomies
14 Chapter 10: Data Integration and Interoperability
Section 10.1: Integration Patterns & Technologies Section 10.2: Replication & Virtualization Section 10.3: Canonical Models & Integration Standards
15 Chapter 11: Data Security
Section 11.1: Security Principles: CIA Triad & Privacy Section 11.2: Access Control & Encryption Section 11.3: Security Regulations & Standards
16 Chapter 12: Data Storage and Operations
Section 12.1: Database Technologies & DBA Roles Section 12.2: Backup, Recovery, and High Availability Section 12.3: Performance Tuning & Operations
17 Chapter 13: Big Data and Data Science
13.1 Big Data V's & Technologies
18 Chapter 14: Data Ethics
14.1 DMBoK Data Ethics Framework
19 Chapter 15: Data Management Process and Maturity
15.1 Maturity Assessment Frameworks
Section 11.2: Access Control & Encryption
Key Takeaways Explain This Topic AI
Authentication (AuthN) verifies the identity of an entity, whereas Authorization (AuthZ) establishes the rights and permissions to resources.
Role-Based Access Control (RBAC) maps permissions to predefined job roles, which can risk role explosion; Attribute-Based Access Control (ABAC) dynamically grants access based on user, resource, environment, and action attributes.
Encryption at Rest secures stored data using symmetric algorithms like AES-256 under key management protocols, while Encryption in Transit protects data across networks using TLS (formerly SSL).
Hashing is an irreversible one-way process used to verify integrity, Dynamic Data Masking (DDM) alters data representation on the fly, and Tokenization swaps sensitive values with tokens to reduce audit scope.
Last updated: July 2026
Authentication vs. Authorization
Before exploring access control models, it is essential to distinguish between two foundational security processes: Authentication (AuthN) and Authorization (AuthZ) .
Authentication is the process of verifying the identity of a user, system, or application (e.g., "Are you who you claim to be?"). This is typically achieved using credentials such as usernames and passwords, cryptographic tokens, or biometrics.
Authorization is the process of determining what resources or actions an authenticated identity is permitted to access (e.g., "What are you allowed to do?"). Access control models focus primarily on authorization.
Access Control Models
Organizations utilize different access control models to manage permissions. The two primary models defined in data security architecture are Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) .
Role-Based Access Control (RBAC)
In Role-Based Access Control (RBAC) , access permissions are assigned to specific business roles rather than individual users. Users are assigned to one or more roles based on their job functions.
Advantage : It simplifies administration because when employees change jobs, administrators only need to change their role assignment rather than adjusting individual resource permissions.
Disadvantage : It can lead to role explosion , a scenario where an organization creates too many unique, highly granular roles (e.g., "HR Analyst Department 4 North") to accommodate specific exceptions, making management difficult.
Attribute-Based Access Control (ABAC)
In Attribute-Based Access Control (ABAC) , access permissions are evaluated dynamically at runtime based on a set of rules and attributes:
User Attributes : Job title, department, security clearance, or certifications.
Resource Attributes : Data classification level, creation date, department owner, or file type.
Environmental/Context Attributes : Time of day, geographical location (IP address), device security status, or connection type.
Action Attributes : Read, write, execute, or delete.
Advantage : Highly flexible, fine-grained, and avoids role explosion.
Disadvantage : Requires greater computational overhead to evaluate policies dynamically on every request.
Feature Role-Based Access Control (RBAC) Attribute-Based Access Control (ABAC)
Access Decision Based on predefined job roles. Based on dynamic attributes of user, data, and environment.
Complexity Low to moderate; simple to design. High; requires a policy evaluation engine.
Scalability Suffers from "role explosion" in large firms. Highly scalable; policy rules can apply to millions of users.
Context Awareness Insensitive to context (e.g., same access day/night). Fully context-aware (e.g., restrict access outside of business hours).
Cryptography: Encryption at Rest vs. In Transit
Cryptography is the practice of securing information by transforming it into an unreadable format (ciphertext). When authorized parties want to read the data, they decrypt it back into its original format (plaintext) using a cryptographic key.
Encryption at Rest
Encryption at Rest protects data stored on physical media, such as hard drives, databases, solid-state drives, backups, and cloud storage buckets.
Purpose : To prevent data exposure if physical storage drives are stolen, or if database backup files are leaked.
Common Standards : The industry standard is the Advanced Encryption Standard (AES) , typically using a 256-bit key length (AES-256), which is a symmetric key algorithm.
Key Management : The biggest challenge of encryption at rest is secure key management. If keys are stored alongside the encrypted data, the encryption is useless. Organizations use Key Management Systems (KMS) or hardware-based Hardware Security Modules (HSMs) to generate, store, rotate, and destroy keys.
Encryption in Transit
Encryption in Transit (also known as encryption in flight) protects data as it moves across networks, such as the Internet or internal enterprise networks.
Purpose : To prevent eavesdropping, intercepting, or modifying data during transmission (Man-in-the-Middle attacks).
Common Standards : Secure network transmissions rely on Transport Layer Security (TLS) (which has replaced the deprecated Secure Sockets Layer [SSL] ). TLS establishes an encrypted session via a handshake using public-key cryptography (asymmetric) and then switches to symmetric encryption for faster data transfer.
Advanced Data Protection Techniques
In addition to encryption, several techniques are used to secure data based on use cases:
Hashing
Hashing is the process of mapping data of arbitrary size to a fixed-size string of characters using a mathematical algorithm (such as SHA-256). Hashing is a one-way function , meaning it is mathematically impossible to reverse the hash to retrieve the original plaintext.
Salting : To prevent attackers from using precomputed lookup tables (rainbow tables) to crack hashes, a random string called a salt is appended to the plaintext before hashing.
Use Cases : Verifying data integrity (detecting tampering) and storing passwords securely.
Dynamic Data Masking (DDM)
Dynamic Data Masking (DDM) is a security control that hides sensitive data on the fly as it is queried, without altering the underlying data on the disk.
How it Works : A query engine intercepts the database query. If the user does not have permissions to view sensitive data, the database returns masked values (e.g., masking credit card digits XXXX-XXXX-XXXX-4321 or a phone number XXX-XXX-1234 ).
Use Cases : Customer service agents viewing account profiles, or developers querying production database replicas.
Tokenization
Tokenization is the process of replacing sensitive data with a non-sensitive surrogate value called a token .
How it Works : Unlike encryption, which uses mathematical algorithms to transform data, tokenization maps the sensitive data to a randomly generated token and stores the mapping in a highly secure, centralized database called a token vault .
Use Cases : Tokenization is widely used in payment card processing. The merchant stores only the token, reducing the scope of Payment Card Industry Data Security Standard (PCI-DSS) audits because the merchant's tokenized databases do not hold actual cardholder data.