A stolen office laptop's disk was readable when it was attached to another machine. The VPN had encrypted the laptop's traffic only while the laptop was online. Which control was missing?
Select an answer to reveal the explanation.
Short Explanation
The VPN locked the traffic while the laptop was on the road, and it did nothing for the disk once someone walked off with the machine. You were missing encryption of data at rest, which would have left that disk unreadable on another computer. The transit encryption you already had, a hash that only detects a change, or tokenization of a database somewhere else does not scramble the stolen drive.
Full Explanation
Encryption of data at rest protects stored data when the disk is moved to another machine. The office disk was readable after the theft, so that control was missing. The VPN encrypted traffic only while the laptop was online. That is encryption in transit, and it is the tempting twin because encryption was present. It ended when the laptop left the network, and it does not protect the disk on another machine. Hashing can show that a file changed. It does not make the disk unreadable. Tokenization replaces sensitive values in a central database. It does not encrypt this laptop disk. Exam caveat: full-disk encryption has to be active, and the key must not sit in the same bag as the laptop. Operational check: attach a test disk to another machine and confirm the files are unreadable without the key, then confirm a VPN session still encrypts traffic while the laptop is online. Record the reading before the change and the reading after it so the next shift can see the symptom actually moved.