3.3 Compare and contrast concepts and strategies to protect data

Question 1

Data Classifications

Answer 1

• Commercial Business
  
  • Public: Press releases. No harm if public.
  • Sensitive: Customer contacts. Minor impact.
  • Private: Payroll data. Protect privacy.
  • Confidential: Trade secrets. Competitive risk.
  • Critical (Restricted): Encryption keys. Severe loss.
• Government
  
  • Unclassified: Reports. Safe to share.
  • Sensitive, but Unclassified: Health records. Private, not critical.
  • Confidential: Memos. Affects operations.
  • Secret: Military plans. National risk.
  • Top Secret: Nuclear codes. Highest threat.

Question 2

Data States and Data Encryption Levels

Answer 2

• Data at Rest
  
  • Stored in databases, file systems, or storage systems, not actively moving.
  • Encryption Methods:
    
    • Full Disk Encryption (FDE): Encrypts the entire hard drive.
    • Partition Encryption: Encrypts specific partitions.
    • File Encryption: Encrypts individual files.
    • Volume Encryption: Encrypts selected files or directories.
    • Database Encryption: Encrypts at column, row, or table levels.
    • Record Encryption: Encrypts specific fields in records.
• Data in Transit (Data in Motion)
  
  • Actively moving between locations, vulnerable to interception.
  • Transport Encryption Methods:
    
    • SSL/TLS: Secures web and email communications.
    • VPN: Creates secure connections over insecure networks.
    • IPSec: Authenticates and encrypts IP packets.
• Data in Use
  
  • Being created, retrieved, updated, or deleted.
  • Protection Measures:
    
    • Application-Level Encryption: Encrypts data during processing.
    • Access Controls
    • Secure Enclaves: Isolated environments (like bio data storage on iPhone)
    • INTEL Software Guard: Encrypts data in memory.

Question 3

Data Types

Answer 3

• Regulated Data: Controlled by laws (e.g., GDPR, HIPAA).
• PII (Personally Identifiable Information): Identifies individuals (e.g., names, SSNs).
• PHI (Protected Health Information): Health data protected under HIPAA.
• Intellectual Property (IP): Inventions or designs protected by patents and copyrights.
  
  • Trade Secrets: Confidential business information, legally safeguarded.
• Legal Information: Related to legal cases; requires strict confidentiality.
• Financial Information: Includes transactions and bank data, regulated by PCI DSS.

• Human-Readable Data: Directly understandable by people (e.g., text).
• Non-Human-Readable Data: Requires software to interpret (e.g., binary).