For both SL and HL, encryption makes data unreadable without the correct cryptographic key, while data masking hides or replaces sensitive values so users can work with data without seeing the originals. Encryption mainly protects stored or transmitted data; masking mainly limits exposure during use.
Encryption applies a mathematical algorithm to plaintext, producing unreadable ciphertext. An authorized user or system uses the correct key to decrypt the ciphertext and recover the original data. For example, an encrypted student record remains unreadable if an unauthorized person obtains the database file.
Data masking substitutes, scrambles, or conceals selected fields while usually preserving their format. A school might display a student identifier as ****4821, or replace real names with realistic fictional names in a testing database. Static masking creates a separate masked copy, while dynamic masking changes what particular users can see without altering the stored original.
| Feature | Encryption | Data masking |
|---|---|---|
| Main purpose | Prevent unauthorized access to data | Prevent unnecessary exposure of sensitive values |
| Original recoverable? | Yes, with the correct key | Usually not from the masked copy itself |
| Typical use | Data at rest or in transit | Testing, analysis, training, or restricted displays |
| Data appearance | Unreadable ciphertext | Realistic, altered, or partly hidden values |
| Key required? | Yes | Not normally for users of the masked data |
A common misconception is that masking provides the same security as encryption. It does not: poorly masked data may be re-identified by combining it with other data, while encryption depends on secure algorithms and effective key management.
In an IB Digital Society exam, this relates to data security in syllabus area 3.1G. For an Explain question, identify the different purposes and then develop each point with a reason or example. Do not merely state that both methods “hide data”; distinguish protection from unauthorized access from limiting visibility during legitimate use.
