Data States and Encryption at Rest

Lesson plan

Level

Beginner

Time

About 55 minutes; the steps below add up to 53

Learners follow one pupil record from disk to screen, and predict whether an encrypted laptop protects a signed-in teacher, before the three states and the levels are named. Predictions then precede nested locks, when full-disk encryption works best, a shared computer, a new self-encrypting drive and what an administrator sees; checks follow the on-screen state, the café day, BitLocker and the safeguarding field. The habit to build: name the threat first, then choose the level that answers it.

Objectives

• Describe the three states of data and why each needs its own protection
• Explain full-disk, partition, volume and file-level encryption, and what each protects against
• Describe BitLocker, EFS and self-encrypting drives
• Compare whole-database and column or record encryption
• Match an encryption level to a threat

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the encryption and key-management lessons first.
• Draw the nested rings on the board: room, cabinet, envelope, letter.
• The lesson takes about 53 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe the three states of data and why each needs its own protection
   • Explain full-disk, partition, volume and file-level encryption, and what each protects against
   • Describe BitLocker, EFS and self-encrypting drives
   • Compare whole-database and column or record encryption
   • Match an encryption level to a threat

   Purpose: Learners follow one pupil record from disk to screen, and predict whether an encrypted laptop protects a signed-in teacher, before the three states and the levels are named. Predictions then precede nested locks, when full-disk encryption works best, a shared computer, a new self-encrypting drive and what an administrator sees; checks follow the on-screen state, the café day, BitLocker and the safeguarding field. The habit to build: name the threat first, then choose the level that answers it.

2. 1. One pupil record Think 5 min

   Purpose: Raise the three states, and the limit of disk encryption, from one record.

   Ask

   • Where could someone get at the record?
   • Can the café thief read the files?

   Responses to expect

   • Most expect the encrypted laptop to be safe.
   • On screen in turns: the opening question, its answer; then the question on a laptop in a café, and its answer.

   Discussion pause: Ask what “encrypted” protected at the moment of the theft.

   In the lesson window

   • Think it through: Think of one pupil’s record: stored in the school’s database, sent to an administrator’s browser, then shown on her screen. Where could someone get at it, and would the same protection cover all three?
   • Think it through: A teacher’s laptop with an encrypted drive is taken from a café table while she is signed in. Can the thief read her files?

3. 2. The three states of data Explain 6 min

   Purpose: Name at rest, in transit and in use.

   Ask

   • Which state is the record in on screen?

   Responses to expect

   • In use: in memory and on the screen.
   • The protection column is held back: ask what would protect data in each state before revealing it.
   • On screen in turns: the opening; then three states, with their typical protection held back; the typical protection for each; data in motion; each state needs its own protection; one pupil record, three states, starting at rest; in transit; in use; a gap anywhere; the check question on the state on screen, and its answer; data in use is the hardest; the rest of this lesson.

   In the lesson window

   • Check your understanding: In the example, which state is the record in while it is shown on screen?

4. 3. Levels of encryption for data at rest Predict 4 min

   Purpose: Introduce the nested levels.

   Ask

   • Who can read the letter?

   Responses to expect

   • Whoever holds the cabinet key, and nobody else.
   • On screen in turns: the opening; then five levels, with what each does not protect held back; what each does not protect against; the question on a letter in a cabinet, and its answer; levels inside one another; five levels, from the outside in; partition or volume; file; database; record or column.

   Discussion pause: The “does not protect against” column is held back: ask who could still read the data at each level before revealing it. Then build the nested diagram from the outside in.

   In the lesson window

   • Think it through: A letter inside an envelope, inside a locked cabinet, inside a locked room. Once the room is open but the cabinet is still locked, who can read the letter? What does that suggest about layers of encryption?

5. 4. Full-disk encryption Predict 7 min

   Purpose: Explain full-disk, partition and volume encryption and their limit, with the teacher’s laptop.

   Ask

   • When does it protect best?
   • Why not on the café day?

   Responses to expect

   • The unlocked-device limit is the key point.
   • On screen in turns: the opening; then the laptop left on a train; the question on when full-disk encryption protects best, and its answer; its exact limit; a teacher’s laptop lost twice, starting with the train; the café; what changed; the check question on the café, and its answer; partition and volume encryption.

   Misconceptions to challenge

   • A learner may believe: “Full-disk encryption protects a running, signed-in laptop.” Respond: Once unlocked, the drive reads as normal.

   In the lesson window

   • Think it through: Full-disk encryption protects a laptop best when it is…
   • Check your understanding: Why did full-disk encryption not help on the day of the café?

6. 5. File-level encryption Predict 4 min

   Purpose: Explain file-level encryption and how it complements full-disk.

   Ask

   • Can two users read each other’s files?

   Responses to expect

   • Yes, without file-level encryption.
   • On screen in turns: the opening; then the question on a shared computer, and its answer; file-level encryption; its weakness; not alternatives.

   In the lesson window

   • Think it through: Two people share one computer whose disk is fully encrypted. Once it is signed in, can each read the other’s files? What would stop that?

7. 6. BitLocker and EFS Explain 4 min

   Purpose: Name BitLocker and EFS as one example of each.

   Ask

   • Which encrypts volumes?

   Responses to expect

   • BitLocker.
   • On screen in turns: the opening; then BitLocker; the Encrypting File System; the check question on BitLocker or EFS, and its answer; BitLocker and EFS, side by side.

   In the lesson window

   • Check your understanding: Which Windows feature encrypts whole volumes, working with the TPM?

8. 7. Self-encrypting drives Predict 4 min

   Purpose: Describe self-encrypting drives and their cautions.

   Ask

   • Is a new SED protected?

   Responses to expect

   • Not until authentication is set up.
   • On screen in turns: the opening; then the question on a drive on day one, and its answer; advantages and cautions; cautions.

   In the lesson window

   • Think it through: A self-encrypting drive encrypts everything from the start. Is its data protected the day it is installed?

9. 8. Database and record-level encryption Predict 8 min

   Purpose: Compare whole-database and column or record encryption, and choose levels by threat.

   Ask

   • What does the administrator see?
   • Which level hides the safeguarding notes?

   Responses to expect

   • Whole-database is often thought to stop administrators.
   • On screen in turns: the opening; then the question on an administrator’s query, and its answer; whole-database encryption; column and record-level encryption; the check question on safeguarding notes, and its answer; choosing the level, starting with a laptop on a train; the shared office PC; backups sent elsewhere; the database administrator; no single level answers all four.

   Misconceptions to challenge

   • A learner may believe: “Encrypting the database stops administrators reading it.” Respond: Only column or record encryption with separate keys does.

   If the explanation does not land: Use a school office: the building is locked at night (whole database), but one drawer has its own key (column).

   To go further

   • Why is column-level encryption used only for some fields, not all of them?

   In the lesson window

   • Think it through: A database is encrypted on disk. The database administrator runs a query. What does she see?
   • Check your understanding: Which level stops a database administrator reading safeguarding notes she does not need?

10. 9. Security+ terminology Explain 1 min

    Purpose: Link the lesson to the Security+ wording.

    Ask

    • Which levels are listed?

    Responses to expect

    • Full-disk, partition, file, volume, database and record.
    • On screen in turns: the opening; then what the objectives do not name.

11. 10. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • Backups test whole-database; the attachment tests states; the bus tests full-disk.
    • On screen in turns: the opening; then the question on backups sent elsewhere, and its answer; the question on an emailed attachment, and its answer; the question on a laptop on a bus, and its answer.

    In the lesson window

    • Apply it: A school sends database backups to an outside storage provider. Which level of encryption covers them?
    • Apply it: A file on a fully encrypted laptop is emailed as an ordinary attachment. Is it protected on its way?
    • Apply it: Teachers keep pupils’ reports on laptops they take home. Which single measure best covers a laptop left switched off on a bus?

12. 11. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The level questions link to the choosing example.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

13. 12. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the three states of data.

    Responses to expect

    • At rest, in transit, in use.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

14. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Three states, three protections.
    • Off or locked, not open.
    • Whole storage or one user’s files.
    • Files and backups, or fields.
    • Threat first, level second.

Consolidation

• Three states, three protections.
• Off or locked, not open.
• Whole storage or one user’s files.
• Files and backups, or fields.
• Threat first, level second.