2.4 Manage Data Life Cycle Flashcards
At what stage of the Data Lifecycle should Data be protected?
EVERY STAGE | Create, Store, Use, Share, Archive, Destroy
When should data be assigned a Classification?
At the moment of procurement, whether that be creation, collection, or update.
Following Data Creation and Classification, what five activities are impacted by the classification level?
Storage, Usage, Sharing, Archiving, and Destruction.
In the Data Lifecycle, when can Data’s Classification Level Change?
At any level of the process. It should be protected according to the classification assigned to the lifecycle process level.
What are the purpose of all 6 Activities contained in the Data Lifecycle? [Create, Store, Use, Share, Archive, Destroy]
Generation of new content, or alteration/modification of old content. | Commiting digital data to some sort of storage repository (often simultaneous with creation) | Data viewed, processed, or used in any way other than modificatoin | Information made accessible by other, such as employees, customers, and partners | Data leaves active-use and moves to long-term storage | Data is permanently detroyed using physyical or digital means.
What is it called when you can prove that there’s no possible way to revocer data that has been securely destroyed?
Defensible Destruction
What are the three primary data sanitization categories?
Destruction, Purging, and Clearing.
What is Data Destruction? Give Examples
The physical destruction of media; most effective means of sanitization. | Incineration of hard drive or drilling holes in the media.
What is Data Purging? Give Examples
Logical/Physical techniques used to sanitize so data cannot be reconstructed. | Degaussing by applying a magnetic field to corrupt the contained data, but can make the data unusable. Also, crypto-shredding to encrypt the data using strong algorithyms.
What is Data Clearing?
Logical Techniques to sanitize data, which may be recoverable; least effecetive destruction technique. | Overwriting existing data with all 1’s or 0’s, though this can sometimes be reversed. As well, Formatting is insecure since some methods simply move pointers so the data is not accesible.
What is the purpose of Crypto-Shredding?
Crypto-Shredding is used to purge data. It encrypts data meant for destruction using AES-258 or similar encryption methods. The encryption key is then immediately destroyed rending the data inaccessible unless a flaw in the encryption method is discovered or the key is brute-forced.
What is ‘Object Reuse’ in the Data Lifecyle?
The act of writing over existing data media multiple times as a means of destruction. This alows the organization to reuse the data with some level of assurance that the former data can no longer be recovered while maintaining usability of the target media.
What should be the first choice option when looking to destroy data on an SSD?
Using vendor/manufacturer provided sanitization capabilities.
If you cannot get sanitization capabilities for your SSD card, what should you do to ensure the data cannot be recovered?
Physical Destruction (Insert Burning Elmo Meme)
What is the best method for ensuring destruction of data that is handled by a third-party?
Crypto-Shredding (Physical is also good, but likely unfeasible with cloud providers)
