Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Next Gig > Cloud Data Security > Flashcards

Cloud Data Security Flashcards

1
Q

List data lifecycle phases

A 
Create
Store
Use
Share
Archive
Destroy

Nmemonic - Colorado State University Stinks at Dodgeball

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In the cloud data lifecycle list examples of data in the create phase?

A

New Data can be:
Freshly generated
Imported data new to the cloud
Data that has been updated/modified and has a new shape or state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q
  1. Describe the create phase.

2. What actions should be performed on data in the create phase?

A
  1. Data/digital content is CREATED, ACQUIRED, VERSIONED OR MODIFIED
2. 
Classify, Tag/Label data
Ensure the right security controls are implemented
Tag data with important attributes
Assign access restrictions, as needed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  1. Describe the Store phase.

2. What activities happen during the Store phase of the cloud data lifecycle?

A
  1. Committing the data to some sort of STORAGE repository
  2. Store
    Assign and PROTECT with security controls (e.g. ENCRYPTION, ACL, logging, monitoring)
    Consider back up
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  1. What happens in the Use phase of the cloud data lifecycle?
  2. What is not included?
A
  1. Viewing, processing, or using/consuming of data previously stored
    data is protected with DLP, DRM/IRM
  2. Read-only phase, so no modifications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What state must data be in order to be in the Use Phase?

Given this state what security mitigations should be taken?

A

Data must be unencrypted to be used

File access monitors, logging and monitoring, or Information Rights Management systems are important to detect and prevent unauthorized access during this phase

Should only be used based on NTK and Least Privileged

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Share Phase of Cloud Data Lifecycle

A

Data is made available for use by others, such as employees, customers, and partners.

Should only be shared based on NTK and Least Privileged

data is PROTECTED with DLP, DRM/IRM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What security mitigations should be taken during the share phase of the cloud data lifecycle?

A

Proper encryption (in transit) is important during this phase, as well as IRM and Data Loss Prevention (DLP) technologies that help ensure sensitive data stays out of the wrong hands.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Archive Phase of Cloud Data Lifecycle

Example activity during Archive Phase

A

The Archive phase involves data transitioning from active use to long-term “cold” storage. Archiving can entail moving data from a primary storage tier to a slower, less redundant tier that is less expensive or can include moving data off the cloud to a separate medium altogether (backup tape, for example).

Cost and availability considerations can affected data access (hard to get data back from LTS)

Ex of activity Data Retention Policy enacted, Encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Destroy Phase of Cloud Data Lifecycle

A

Destroying data involves completely removing it from the cloud by means of logical erasure or physical destruction (like disk pulverizing or degaussing).

In cloud environments, customers generally have to rely on logical destruction methods like crypto-shredding, purge, clearing or data overwriting, but many CSPs have processes for physical destruction, per contractual agreements and regulatory requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Data dispersion

A

Data dispersion is the process of replicating data throughout a distributed storage infrastructure that can span several regions, cities, or even countries around the world.

each storage block is fragmented and storage application writes each bit into different physical storage containers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Erasure coding

A

A more specific implementation of data dispersion, it enhances data security by segmenting a file, encrypting the segments and then spreading the segments out across multiple locations — meaning a compromise of any location would yield only a portion of the file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Volume

A

A volume is a virtual hard drive that can be attached to a Virtual Machine (VM) and utilized similar to a physical hard drive. The VM Operating System views the volume the same way any OS would view a physical hard drive in a traditional server model.

AKA Block Storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Object?

Object Storage?

A

An object is file storage that can be accessed directly through an API or web interface, without being attached to an Operating System

Object storage consist of the files that are actually just virtual objects in an independent storage structure that rely on key values to reference and retrieve them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What type of storage does PaaS utilize?

A

Structured storage - RDBMS and others for searching and running operations

Unstructured storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What type of data storage is used by SaaS

A

Information Storage and Management - customer data entry into app via web interface, the app storing int back end database and generating data on behalf of the customer and stored internally

Content and file storage

Content Delivery Network (CDN)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Ephemeral storage

A

Ephemeral storage is temporary storage that accompanies more permanent storage. Ephemeral storage is useful for temporary data, such as buffers, caches, and session information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Raw-disk storage

A

Raw-disk storage is storage that allows data to be accessed directly at the byte level, rather than through a filesystem.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Threats to storage types

A

Unauthorized access or usage (external or malicious insider)
Data Leakage and exposure - CSPs must protect data when replicated/distributed across regions
Denial of Service - CSP must manage spikes in bandwidth, otherwise data availability is at risk
Corruption or loss of data - read CSPs data terms that include availability and durability SLOs and SLA’s; can happen intentionally or accidentally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Durability (or reliability)

A

Durability (or reliability) is the concept of using data redundancy to ensure that data is not lost, compromised, or corrupted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Durability vs Availability

A

Availability focuses on uptime through redundancy, Durability focuses on reliability through redundancy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Data loss prevention (DLP)

A

Data loss prevention (DLP), also known as data leakage prevention, is the set of technologies and practices used to identify and classify sensitive data, while ensuring that sensitive data is not lost or accessed by unauthorized parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Components of DLP?

A

Discovery and classification - first stage of DLP
Monitoring - monitoring the data against one or more policies; if policy is violated, the system provides an alert
Enforcement - policy violations are logged/alerted, or blocked from unauthorized exposure or loss and kept inside boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

DLP Implementation/Architecture

A

Data At Rest - At Rest Implementation runs where the data is stored (cloud or endpoint device, e.g. workstation, file server, and other storage system)

Data in Motion/Transit - Network-based DLP protect data in transit, monitors outbound traffic (HTTP, HTTPS, FTP, SMTP) near network perimeter

Data in Use - data being processed in RAM and/or CPU. DLP should be installed on endpoint device (host/client-based DLP) preventing sharing or processing of data that violates policy

Host-based or endpoint-based DLP run on workstation or other endpoint device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Data de-identification/Anonymization

A

Data de-identification (or anonymization) is the process of removing information that can be used to identify a specific individual from a dataset.

Data sanitization technique with an intent to protect privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Name Techniques available to de-identify or anonymize sensitive information

A

Masking (obfuscation)

Tokenization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Masking

A

Masking is the process of partially or completely replacing sensitive data with random characters or other nonsensitive data.

Masking entails hiding, replacing, or omitting specific fields or data in particular user views in order to limit data exposure in the production environment.

28
Q

List masking techniques

A

Substitution SECRET=$3(837
Scrambling/Shuffling SECRET = TEESRC
Deletion or nulling SECRET = EE

29
Q

Substitution

A

Substitution is a de-identification or anonymization masking technique that mimics the look of real data, but replaces (or appends) it with some unrelated value.

Substitution can either be RANDOM or ALGORITHMIC, with the latter allowing two-way substitution — meaning if you have the algorithm, then you can retrieve the original data from the masked dataset

30
Q

Scrambling

A

Scrambling is a de-identification or anonymizing masking technique that mimics the look of real data, but simply jumbles the characters into a random order.

31
Q

Deletion or nulling

A

Deletion or nulling is a de-identification or anonymization masking technique is just what it sounds like. When using this masking technique, data appears blank or empty to anyone who isn’t authorized to view it.

32
Q

Data masking approach?

A

Static data masking - a new copy fo the data is created with the masked value

Dynamic data masking - on the fly masking that adds a layer of masking between app and DB

33
Q

Static Data masking - Typical Use-case

A

Static masking is the better option when you need to use “real” data in a development or test environment.

34
Q

Dynamic data masking - Typical Use-case

A

Requires a masking layer in between the storage component and the application. This type of masking is great when you need to use production environments in a confidential or private manner.

35
Q

Tokenization

A

Tokenization is the process of substituting a sensitive piece of data with a nonsensitive replacement, called a token. The token is merely a reference back to the sensitive data, but has no meaning or sensitivity on its own.

Tokenization is able to track back to the original data (two way function), but it is expensive.

Important to make sure proper authentication is being done when storing and accessing sensitive data

36
Q

Data discovery

A

Data discovery is the process of finding and identifying sensitive information in your environment.

37
Q

Approaches to data discovery

A

Metadata - use meta data to find it
Labels - label sensitive data to find it
Content - analyze the actual content

38
Q

Data classification

A

Data classification is the process of categorizing and organizing data based on level of sensitivity or other characteristics.

critical component for risk management, data security, and compliance.

39
Q

Categories of Sensitive Data

A

Protected Health Information (PHI)
Personally Identifiable Information (PII)
Cardholder data

40
Q

Describe types of PII

A

Nonsensitive PII includes data that can be used to identify an individual, but are publicly available
Sensitive PII information not publicly available

Direct identifiers can be used on their own to identify an individual. (e.g. SSN) 1:1 identification

Indirect identifiers can help narrow down a set of individuals, but cannot be used to identify a single individual on its own (e.g. birthdate)

41
Q

Aggregate risk

A

aggregate risk — multiple pieces of information can be combined to create something more sensitive than any of its individual components.

42
Q

PHI

A

Protected health information (PHI) is information related to the past, present, or future health status of an individual that was created, used, or obtained in the course of providing healthcare services, including payment for such services.

Can also include PII

43
Q

IRM

A

Information Rights Management (IRM) is a data security technology that protects data (typically files, but also emails, web pages, and other information) from unauthorized access by limiting who can view, copy, forward, delete, or otherwise modify or access information (e.g. print, download, etc).

Commonly implemented with IAM, ACLs and encryption

44
Q

Digital rights management (DRM)

A

Uses ENCRYPTION to enforce COPYRIGHT restriction on digital media

Done to protect intellectual property

Two types: Consumer DRM and Enterprise

45
Q

What recourse does the cloud customer have if inadvertent or malicious disclosure of PII occurs in the cloud WRT the cloud provider? Why?

A

None. Under current law, no cloud customer can transfer risk or liability associated with the onadvertent or malicious disclosure of PII

46
Q

Consumer Digital Rights Management

A

Controlling the access, execution, copying and alteration of copyrighted information from a publisher to the consumer

47
Q

Enterprise Digital Rights Management

A

A solution used by the organization to protect assets such as documents and/or email from within the organization or partners

48
Q

List Key Data Functions

A

Access

Process

Store

49
Q

Align Key Data Functions to Data Lifecycle

A

Access - happens in all phases (Create, Store, Use, Share, Archive, DestroY (ALL)

Process - happens in Create and Use (CPU)

Store - happens in Store and Archive (SAS)

50
Q

List Cloud IaaS Storage

A 
Volume Storage - Block or File
Object Storage
Raw Storage
Ephemeral Storage
Long Term Storage
51
Q

List PaaS Storage

A

Unstructured - Non Relational or NoSQL

Structured - SQL or Relational (RDBMS)

52
Q

List SaaS Data Storage, Describe each

A

Information Storage and Management System - data entered into web interface and stored in SaaS back end DB

Content or File Storage - file based content stored within application

Content Delivery Network (CDN) - content in object storage distributed to multiple geolocations to improve consumption speed

53
Q

Data Annonymization - Indirect vs Direct

A

Direct - sanitization of data that uniquely identified a subject (e.g. name, email, PII)

Indirect - sanitization of data that consist of something other than direct so e.g. demographic, socioeconomic, events, etc.

54
Q

List Media Sanitization Techniques

A
  1. Physical Destruction
  2. Clearing/Overwriting
  3. Purging
  4. Cryptographic erasure/Crypto Shredding
  5. Degaussing
55
Q

Degaussing

A

Magnetically scrambling data on a conventional hard drive or tape drive

Cannot degauss an SSD

56
Q

Clearing/Overwriting

A

Prepping the media for re-use at the same classification level

Data cannot be recovered ty using normal system functions or utilities

However the data may not be immune to recovery with special tools in a lab environment

57
Q

Purging

A

Removing sensitive data from a system with the intent that the data cannot be reconstructed by any known technique

58
Q

Crypto Shredding

A

involves encrypting data and when the data is ready to be retired, destroying the keys so that the data can’t be accessed because it can’t be decrypted

best used with symmetric key encryption because there is only one key to delete and original encrypt is cheaper, faster, and simpler

59
Q

Information Rights Management (IRM)

AKA

A

is a data security technology that protects data (typically files, but also emails, web pages, and other info) from unauthorized access by limiting who can view, copy, forward, delete or otherwise modify information

Provides:

  • Encryption
  • Protection of not just sensitive data but can also be used for the protection of web pages, emails, databases, etc.
  • Access controls, even based on location
  • A baseline for an information protection policy

Data Rights Management (DRM :(, not Digital Rights Management)

60
Q

-Feature Goals of Security Architecture When IRM is Incorporated

A

Continuous protection - despite location or data life cycle or at rest or in transit

Automatic expiration - using IRM, set policy that automatically revoke access to data after a predetermined lifetime

Dynamic Control - using IRM , manage access permissions even when data has been distributed

Auditability - IRM provides continuous audit trail

Integration and support - IRM is usually interoperable with email filters, data formats, and other infrastructure or software in the enterprise

61
Q

Data Retention Policies

A

Retaining information for organization or regulatory COMPLIANCE

62
Q

Data Backup vs Data Archive

A

Data backup - the process of backing up data the organization is CURRENTLY using/processing for disaster recovery purposes

Data archive - retrain data per retention policy that is NO LONGER being used/processed

63
Q

Continuous Monitoring

A

NIST 800-137: Information Security Continuous Monitoring (ISCM) maintaining ongoing AWARENESS of information security, VULNERABILITY, and threats to support organizational risk management decisions

NOT monitoring from a 24x7x365 concept; this is security monitoring as policy on a cyclical basis

64
Q

Information Security Continuous Monitoring (ISCM) Strategy

A
  1. Clear understanding of the organization risk tolerance/appetite
  2. METRICS to understand organizations security status
  3. Ensure security controls are effective
  4. Verifies compliance with corporate governance
  5. Continuous awareness of threats and vulnerabilities
65
Q

Continuous Operations

A

The organization is following these principles:

  1. Audit Logging - giving Sr. Management ASSURANCE the organization is adhering to legal, statutory and regulatory compliance
  2. Contract/authority maintenance: having liaisons between organizations and applicable authorities (regulatory, local, national, legal, jurisdiction) and to be ready to engage with them in case of a forensic investigation
  3. Data governance: POLICIES and PROCEDURES

(Make sure we are always available)

Next Gig (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions