An analytics service decrypts customer records so it can run calculations on them, and the security team is worried that an attacker with access to the host could read the plaintext straight out of RAM while the computation runs. Which data state is exposed, and which protection addresses it most directly?
Select an answer to reveal the explanation.
Short Explanation
Think about where the data sits at the moment of the attack: it's not on the disk and it's not on the wire, it's in memory being worked on. That's data in use, and disk encryption or TLS won't help you there because the data has to be decrypted to be processed. A secure enclave keeps that decrypted data walled off even from the rest of the host.
Full Explanation
Data in use is information that is actively loaded in memory or CPU registers while an application processes it. Because computation generally requires plaintext, the protections that guard stored or transmitted data have already been peeled away at this point. A hardware-based secure enclave, or trusted execution environment, isolates a region of memory so that code and data inside it cannot be read by the operating system, the hypervisor or other processes, which is exactly the exposure described. Full-disk encryption protects data at rest; it is transparent to a running system, so the records are already decrypted by the time they reach RAM and an attacker on the host gains nothing from it. TLS protects data in transit between tiers and terminates before the analytics code ever touches the records. Tokenization before storage reduces what is kept at rest, but the service in this scenario must work on real values, so the plaintext still lands in memory. Exam caveat: classify the state by where the data is at the moment of the threat, not by where it usually lives. Operational check: confirm the workload runs on hardware that supports enclaves, that the sensitive processing step executes inside the enclave, and that memory dumps of the host no longer expose the decrypted records.