Two locks: securing the system and securing the data

Picture an office with two locks.

The door keeps people out of the room. The safe keeps people out of the documents once they are inside.

• If a stranger picks the door lock, they still have to deal with the safe.
• If someone walks out with the safe under their arm, the door lock was pointless — the protection did not travel with the valuables.

Computer security works the same way:

• System security is the door: the machine, its operating system, its software and its network.
• Data security is the safe: the actual files and records, wherever they go.

Where the analogy breaks: data is not a heavy safe. It can be copied in seconds and leave the building in an email attachment, a USB stick or a cloud sync, without anyone carrying anything.

System security can be perfect and the data can still leak, because the strongest lock is useless if someone with the key carries the contents out.

• Authorised users can misuse access. A support agent with a valid login who downloads every customer record has bypassed nothing. Only limited access rights and audit logs reduce the damage.
• Copies leave the system. A backup tape in a van, a USB stick in a pocket, a file emailed to a personal account, a laptop left on a train — none of these are behind the firewall any more. Only protection attached to the data (encryption) still helps.
• Data is shared with other organisations. Once data is sent to a partner or a cloud service, your system's login controls no longer apply to it.
• Accidental disclosure — printing a report and leaving it on a desk, emailing the wrong recipient, a misconfigured cloud folder — breaks data security with no attacker at all.

It works the other way too. Encryption is a lock on the contents, not on the machine.

• Malware can steal the key. Spyware that records keystrokes or reads memory can capture a password or an encryption key. Encryption in that case protects nothing.
• A compromised system can delete or corrupt data. Encryption does not stop an attacker destroying the file, and a ransomware program can encrypt it with a key the owner does not have.
• An attacker can use your machine as a weapon — for example joining it to a botnet to attack other systems — even if they never read your files.
• A compromised operating system can read data after it has been decrypted. Once malicious code runs with administrator rights, it sees what the user sees.
• Unpatched software is an open window. If a known flaw is not fixed, an attacker can enter through it and disable every other measure from the inside.