2.1 How Computers Process, Store, and Move Data
The Data Path in One Sentence
Every computation ends with the same three moves: the CPU pulls bytes upward from RAM, RAM is refilled from persistent storage when data is not resident, and the network interface card (NIC) pushes copies of those bytes off the machine. Security matters at each hop because each layer has a different exposure window: RAM is sniffable with physical access, disks hold the data longest, and the NIC is the only path an attacker across the internet can touch directly.
Processing: The Clock Cycle and the Fetch-Decode-Execute Loop
A CPU core advances on a clock. At 3.4 GHz the oscillator ticks 3,400,000,000 times per second, and each tick moves work in the fetch-decode-execute loop: the program counter names an address in RAM, the core loads the instruction bytes from that address, decodes the opcode into a micro-operation, executes it in an arithmetic or branch unit, and writes the result back to a register. Modern cores run several of these pipelines at once, so one add rax, rbx may retire alongside unrelated instructions. The security detail: the CPU keeps no private copy of truth, so whatever sits in RAM (keys, tokens, plaintext) defines the blast radius.
Storage: Volatile RAM and the Page Fault Path
RAM is volatile and byte-addressable; power off and the cells decay within seconds (faster with cold-boot mitigations like memory encryption such as AMD SME). Storage is persistent and block-addressable: an SSD answers read requests for logical blocks (LBA 2048), and the filesystem maps a path like /etc/passwd to those blocks. When a process touches a memory page not currently in RAM, the CPU raises a page fault; the kernel either maps a fresh zero page, memory-maps a file region, or evicts a cold page to swap and reloads the requested one. That fault is why a locked laptop still holds decrypted data: if pages are resident, nothing re-encrypts them until they are evicted or power is cut.
Moving Data: NIC, DMA, and Frames
Network traffic avoids the CPU when possible. The kernel places descriptors in a ring buffer, and the NIC uses direct memory access (DMA) to read a fully assembled TCP segment straight out of RAM, wrap it in an Ethernet frame with a destination MAC, and place it on the wire. Interrupts only fire to report completion. This is why NICs can saturate gigabit links while the CPU sits idle, and why full-disk encryption alone does not protect data mid-transit; that is the job of TLS above the transport layer.
Architecture Diagram
Key Takeaways
- The CPU processes only copies of bytes already fetched from RAM; clock speed (
GHz) bounds how fast the fetch-decode-execute loop runs. - RAM is volatile and byte-addressable; SSD/HDD are persistent and block-addressable, bridged by paging and page faults.
- Data resident in RAM stays decrypted until evicted or power is lost, which is why sleep states weaken full-disk encryption.
- NICs move data with DMA and interrupts, so encryption at rest does not protect data in transit; use TLS for that.
- Each hop (CPU, RAM, disk, NIC) is a distinct attack surface with different physical and remote exposure.