Chapter 3 – Data Classification Flashcards
Data Ownership
assign responsibilities according to who has possession and legal ownership of that data.
Data Owner
org that collected/created the data; usually department head/business unit manager; cloud customer is usually the data owner (international treaties/frameworks refer to as the data controller)
Data Custodian
person or entity tasked with the daily maintenance/administration of the data; role of proper security controls and processes as directed by the data owner; sometimes a database admin
Data Processor
any org or person who manipulates, stores, or moves the data on behalf of the data owner; cloud provider is a data processer (international law)
Data processors do not necessarily all have direct relationships with data owners; processors can be third parties or further removed down the supply chain
Data Lifecycle
understand it in order:
Create > Store > Use > Share > Archive > Destroy
Create
data owner will be identified in this first phase; data security and management responsibilities require action; data owner will categorize the data
Data Categorization: Regulatory Compliance
can categorize by specific datasets (GLBA, PCI, SOX, HIPAA, GDPR, other international, national, and local compliance)
Data Categorization: Business Function
different use of data (billing, marketing, operations)
Data Categorization: Functional Unit
department or office with its own category and data controls
Data Categorization: By Project
define datasets by projects associated with as means of creating discrete, compartmentalized projects
Data Categorization: Data Classification
responsibility of the data owner; assigned by the org’s policy based on characteristics of dataset
Sensitivity: used by the US military; assigned to the sensitivity of the data, based on negative impact an unauthorized disclosure would cause
Jurisdiction: geophysical location of the source/storage point of the data might determine how the data is handled; PII gathered from citizens from EU is subject to the EU privacy laws
Criticality: data deems critical to org survival classified in a manner distinct from trivial, basic operational data; BIA helps determine this
Data Categorization: Data Mapping
data between organizations (or departments) normalized and translated so it is meaningful to both parties; in classifications, mapping is necessary so data that is sensitive must be protected in one org must be recognized by the receiving org
Data Categorization: Data Labeling
when data owner creates, categorizes, and classifies the data, it also must be labeled; should indicate who the data owner is (office or role, not name or identity); should take any form to be enduring, understandable, and consistent; Ex: labels on hardcopy data might be printed headers/footers, labels on electronic files might be embedded in the filename/nomenclature; labels should be evident and communicate pertinent concepts without disclosing data they describe;
Data Categorization: What may data labels include?
Date of creation
Date of scheduled destruction/disposal
Confidentiality level
Handling directions
Dissemination/distribution instructions
Access limitations
Source
Jurisdiction
Applicable regulation
Data Discovery
used to refer several kinds of tasks to determine and accurately inventory the data under its control; org is attempting to create an initial inventory of data it owns, org is involved in electronic discovery (e-discovery), and can modern the use of datamining tools to discover trends and relations in the data already in the org’s inventory
E-Discovery: legal term for how electronic evidence is collected as part of an investigation/lawsuit
Label-Based Discovery
labels created will aid in any data discovery efforts; org can determine what data it controls and amounts of each kind; labels are useful when the discovery effort is undertaken in response to a mandate with specific purpose (court order/regulatory demand); can easily collect and disclose all appropriate data if labeled
Metadata-Based Discovery
data about data, a listing of traits and characteristics about specific data elements/sets; can be useful for discovery purposes; data discovery uses metadata the same way as labels to scan field for particular terms for certain purposes
Content-Based Discovery
discovery tools can be used to located and identify specific kinds of data by delving into the content of datasets (even without labels/metadata); basic term searches or sophisticated pattern-matching technologies
Data Analytics
technological options to provide additional findings and assigning types to data; modern tools create new data feeds from sets of data that already exist within the environment; modes used are real-time analytics, datamining, and agile business intelligence
Datamining
an outgrowth of the possibilities offered by regular use of the cloud (big data); when org collects data streams and run queries across the feeds, the org can detect and analyze previously unknown trends and patterns that can be useful
Real-Time Analytics
tools can provide datamining functionality concurrently with data creation and use; the tools rely on automation and require efficiency to perform properly
Agile Business Intelligence
tate-of-the-art datamining involves recursive, iterative tools and processes that can detect trends and identify more oblique patterns in historical and recent data
Jurisdictional Requirements: USA
address privacy with industry-specific legislation (GLBA for banking/insurance, HIPAA for medical care, etc.) or with contractual obligations (PCI); granular data breach notification laws exist that are enforced by states and localities (New York/California); strong protections for intellectual property
Jurisdictional Requirements: Europe
has massive, exhaustive, comprehensive personal privacy protections (EU General Data Protection Regulation); good intellectual property protectio
Jurisdictional Requirements: Asia
data privacy protection levels differ by country; with its Act on the Protection of Personal Information, Japan and Singapore adheres to the EU model, China has a legal requirement the opposite of privacy (all IT traffic and communications in China must be accessible by the Chinese government); disparate levels of intellectual property protection
Jurisdictional Requirements: South/Central America
most countries lack privacy protection frameworks; Argentina is an exception; their Personal Data Protection Act is in direct correlation with the EU legislation; has various intellectual property mechanisms
Jurisdictional Requirements: Australia/New Zealand
has the Australian Privacy Act mapping directly to the EU statutes; provide strong intellectual property protections and strong privacy protections
IRM (Information Rights Management)
managing information in accordance with who has rights to it; can be DRM (digital/data rights management), ERM (enterprise); uses a variety of tools to enforce intellectual property rights such as support-based licensing, local agent enforcement, and media-present checks
Copyright
legal protection for expressions of ideas; in the US, granted to anyone who first creates an expression of an idea (literary works, films, music, software, and artistic works); does not cover ideas, specific words, slogans, recipes, formulae; lasts for 70 years after the author’s death/120 years after the first publication of a work for hire; creator is the only entity legally allowed to do the following: perform the work publicly, profit from the work, make copies of the work, make derivative works from the original, import or export the work, broadcast the work, sell/assign the rights
Trademarks
intended to be applied to specific words and graphics; representations of an org – its brand; can be the name of an org, logo, phrase, color, sound, or combo of these
Patents
legal mechanism for protecting intellectual property in the form of inventions, processes, materials, decorations, and plant life; lasts about 20 years from time of patent application
Trade Secrets
has same aspects as patented material (processes, formulas, commercial methods, etc.); includes aggregations of information (list of clients/supplies)
IRM Tool Traits
material protected by IRM solutions need some form of labeling/metadata associated with the material for the IRM tool to function properly
Rudimentary Reference Checks
content itself can check for proper usage/ownership; Ex: vintage games will pause in operation until player entered information acquired with the purchase of a licensed copy of the game (word/phrase from manual shipped with game)
Online Reference Checks
Microsoft software packages (Windows OS/Office programs) requiring product key at installation; program will check against online database when connected to the Internet
Local Agent Checks
user installs reference tool that checks the protected content against the user’s license; Ex: Steam when installing games purchased, agents check user’s system against online license database to ensure games are not pirated
Presence of Licensed Media
disks for example, is required to be present when the content is being used; IRM engine is on the media, often installed with a cryptographic engine that identifies the unique disk and the licensed content and allowing usage based on that relationship
Support-Based Licensing
predicted on the need of continual support for content (production software); vendor can prevent unlicensed versions from getting support (updates/patches)
What are replication restrictions in IRM in the cloud?
IRM often prevents unauthorized duplication, but the cloud may create, close, and replicate virtualized host instances, which can interfere with automatic resource allocation processes.
What are jurisdictional conflicts in cloud computing?
Cloud services extend across boundaries and borders, which can pose problems when intellectual property rights are restricted by locale.
What are agent/enterprise conflicts in IRM?
IRM solutions requiring local installation of software agents for enforcement may not function properly in cloud environments, virtualization engines, or various BYOD platforms.
How do IAM and IRM conflict?
The extra layer of access control (ACLs) can cause conflicts between IRM, IAM, and enterprise/cloud IAM, especially if outsourced to a third party (CASB).
What are API conflicts in IRM?
IRM tools incorporated into content may not offer the same level of performance across different applications (content readers/media players).
What is persistent protection in IRM?
Persistent protection follows the content it protects regardless of location, duplication, or utilization.
What is dynamic policy control in IRM?
Dynamic policy control allows content creators and data owners to modify ACLs and permissions for the protected data under their control.
What is automatic expiration in IRM?
Protection should cease when legal protections cease, as many digital content licenses expire; access and permissions for protected content should also expire.
What is continuous auditing in IRM?
Continuous auditing allows for comprehensive monitoring of the content’s use and access history.
What are the purposes of replication restrictions in IRM?
The purpose is to restrict illegal or unauthorized duplication of protected content across various forms of copying.
What is remote rights revocation in IRM?
The owner of intellectual property rights should have the ability to revoke rights at any time, often due to litigation or infringement.
What is data control in IRM?
Data control protects data beyond the CREATE lifecycle phase, requiring specific policies for retention, audit, and disposal.
What are retention periods in data retention policy?
Retention periods specify how long an organization should keep data, often mandated by regulation or contractual agreements.
What is applicable regulation in data retention policy?
Applicable regulations can be mandated by statute or contract; policies should refer to all relevant regulatory guidance.
What are retention formats in data retention policy?
Retention formats describe how data is archived, including media storage types and handling specifications.
Example: Some data must be encrypted while in storage.
What is data classification in data retention policy?
Organizations can use data classification levels to determine how long specific datasets or types of data need to be retained.
What are archiving and retrieval procedures?
These procedures mandate detailed descriptions of processes for sending data into storage and recovery.
What is monitoring, maintenance, and enforcement in data retention policy?
This includes details on how often policies will be reviewed, amended, consequences for non-compliance, and responsible entities.
What is legal hold in data retention policy?
Legal hold supersedes retention/destruction policies during litigation, requiring suspension of relevant data destruction activities.
What is data audit?
Organizations need to regularly review, inventory, and inspect the usage and condition of their data, with a defined audit policy.
What is data destruction/disposal in the cloud?
Due to the cloud environment, hardware destruction or overwriting is nearly impossible; crypto-shredding is the primary option for data disposal.
What is crypto-shredding?
Crypto-shredding involves encrypting data with a strong engine, encrypting the keys with another engine, and then destroying the resulting keys.
