Data Protection Flashcards
Data classification
Based on the value to the organization and the sensitivity of the information,
determined by the data owner
Commercial Business Classification Levels
- Public
- Sensitive
- Private
- Confidential
- Critical
Government Classification Levels
- Unclassified
- Sensitive but Unclassified
- Confidential
- Secret
- Top Secret
Data Owner
A senior executive responsible for labeling information assets and ensuring they
are protected with appropriate controls
Data Processor
A group or individual hired by the data controller to assist with tasks like data
collection and processing
Data Controller
Entity responsible for determining data storage, collection, and usage purposes
and methods, as well as ensuring the legality of these processes
Data Steward
Focuses on data quality and metadata, ensuring data is appropriately labeled and
classified, often working under the data owner
Data Custodian
Responsible for managing the systems on which data assets are stored, including
enforcing access controls, encryption, and backup measures
Privacy Officer
Oversees privacy-related data, such as personally identifiable information (PII),
sensitive personal information (SPI), or protected health information (PHI),
ensuring compliance with legal and regulatory frameworks
PII
Personally Identifiable Information
SPI
Sensitive Personal Information
PHI
Personal Health Information
Data Ownership Responsibility
The IT department (CIO or IT personnel) should not be the data owner; data
owners should be individuals from the business side who understand the data’s
content and can make informed decisions about classification
Data at Rest
Data stored in databases, file systems, or storage systems, not actively moving
Encryption Methods for data at rest
- Full Disk Encryption (FDE)
- Partition Encryption
- File Encryption
- Volume Encryption
- Database Encryption
- Record Encryption
Data in Transit
Data actively moving from one location to another, vulnerable to interception
Transport Encryption Methods
- SSL and TLS
- VPN
- IPSec
SSL
Secure Sockets Layer
Secure communication over network, widely used in web browsing and email
TLS
Transport Layer Security
Supersedes SSL
VPN
Virtual Private Network
Creates secure connections (tunnels) over less secure networks like the internet
IPSec
Internet Protocol Security
Secures IP communications by authenticating and encrypting IP packets
Data in Use
Data actively being created, retrieved, updated, or deleted
Data in Use protection methods
- Encryption at application level
- Access Controls
- Secure Enclaves
- Memory Encryption
Secure Enclave
Isolated environment for processing sensitive data
Regulated data
Data that is controlled by laws, regulations, or industry standards. Subject to compliance requirements (GDPR, HIPAA etc.)
GDPR
General Data Protection Regulation
- Protects EU citizens’ data within EU and EEA borders
- Compliance required regardless of data location
- Non-compliance leads to significant fines
HIPAA
Health Insurance Portability and Accountability Act
PCI DSS
Payment Card Industry Data Security Standard
Data Sovereignty
Digital information subject to laws of the country where it’s located
Gained importance with cloud computing’s global data storage
Geographic Restrictions
aka Geofencing
- Virtual boundaries to restrict data access based on location
- Compliance with data sovereignty laws
- Prevent unauthorized access from high-risk locations
Encryption
- Transform plaintext into ciphertext using algorithms and keys
- Protects data at rest and in transit
- Requires decryption key for data recovery
Hashing
- Converts data into fixed-size hash values
- Irreversible one-way function
- Commonly used for password storage
Masking
- Replace some or all data with placeholders (e.g., “x”)
- Partially retains metadata for analysis
- Irreversible de-identification method
Tokenization
- Replace sensitive data with non-sensitive tokens
- Original data stored securely in a separate database
- Often used in payment processing for credit card protection
Obfuscation
- Make data unclear or unintelligible
- Various techniques, including encryption, masking, and pseudonyms
- Hinder unauthorized understanding
Segmentation
- Divide network into separate segments with unique security controls
- Prevent lateral movement in case of a breach
- Limits potential damage
Permission Restrictions
- Define data access and actions through ACLs or RBAC
- Restrict access to authorized users
- Reduce risk of internal data breaches
DLP
Data Loss Prevention
