Data Protection Flashcards
Data protection
Safeguarding information from corruption, compromise, or loss
Data Classification
Based on the value to organization and the sensitivity of the information, determined by the data owner
- Sensitive
- Confidential
- Public
- Restricted
- Private
- Critical
Sensitive data
Information that, if accessed by unauthorized persons, can result in the loss of security or competitive advantage for a company
- over classifying data leads to protecting data at a high level
Importance of data classification
- Helps allocate appropriate protection resources
- Prevents over-classification to avoid excessive costs
- Requires proper policies to identify and classify data accurately
Commercial Business Classification Levels
Public - No impact if released; often publicly accessible data
Sensitive - Minimal impact if released (ex: financial data)
Private - Contains internal personnel or salary information
Confidential - Holds trade secrets, intellectual property, source code, etc
Critical - Extremely valuable and restricted information
Government Classification Levels
Unclassified - Generally releasable to the public; can be released under the Freedom of Information Act
Sensitive, but unclassified - Includes medical records, personnel files, etc. ; no harm to national security
Confidential - Contains information that could affect the government (ex: trade secrets)
Secret - Holds data like military deployment plans, defensive postures
Top Secret - Highest level, highly sensitive national security information
Data Ownership
Process of identifying the individual responsible for maintaining the confidentiality, integrality, availability, and privacy of information assets
Data Owner
a senior executive responsible for labeling information and ensuring they are protected with appropriate controls
Data Controller
Entity responsible for determining data storage, collection, and usage purposes and methods, as well as ensuring the legality of these processes
Data processor
a group or individual hired by the data controller to assist with tasks like data collection and processing
Data Steward
Focuses on data quality and metadata, ensuring data is appropriately labeled and classified, often working under the data owner
Data Custodian
Responsible for managing the systems on which data assets are stored, including enforcing access controls, encryption, and backup measures
Privacy Officer
Oversees privacy-related data, such as PII, SPI, and PHI ensuring compliance with legal and regulatory frameworks
Data Ownership Responsibility
The IT Department (CIO or IT personnel) should NOT be the data owner; data owners should be individuals from the business side who understand the data’s content and can make informed decisions about classification
Selection of Data Owners
Should be designated within their respective departments based on their knowledge of the data and its significance within the organization
- example: CFO controls financial data
Data at Rest
Data stored in databases, file systems, or storage systems, not actively moving
Encryption Methods
- Full Disk Encryption (FDE) = Encrypts the entire hard drive
- ** Partition Encryption** = Encrypts specific partitions, leaving others unencrypted
- Volume Encryption = Encrypts selected files or directories
- Database Encryption = Encrypts data stored in a database at column, row, or table levels
- Record Encryption = Encrypts specific fields within a database record
Data in Transit
Data actively moving from one location to another, vulnerable to interception
Can be protected with transport encryption methods:
- SSL
- VPN
- IPSec
Secure Sockets Layer (SSL)
Secure communication over networks, widely used in web browsing and email
Virtual Private Network (VPN)
Creates secure connections over less secure networks like the internet
Internet Protocol Security (IPSec)
Secures IP communications by authenticating and encrypting IP packets
Data in Use
Data actively being created, retrieved, updated, or deleted
Protection measures:
- Encryption at the application level = encrypts data during procession
- Access controls = Restricts access to data during processing
- Secure Enclaves = Isolated environments for processing sensitive data
- Mechanisms like INTRL Software Guard; encrypts data in memory to prevent unauthorized access
Regulated data
Controlled by laws, regulations, or industry standards
Compliance requirements:
- General Data Protection Regulation (GDPR)
- Health Insurance Portability and Accountability Act (HIPPA)
Personal Identification Information (PII)
Information used to identify and individual
- names
- social security number
- addresses
Protected Health Information (PHI)
Information about health status, healthcare provision, or payment linked to a specific individual
- Protected under HIPAA
Trade Secrets
Confidential business information giving a competitive edge
- legally protected, unauthorized disclosure results in penalties
example:
- manufacturing processes
- marketing strategies
- Proprietary software
Intellectual Property (IP)
Creations of the mind (inventions, literary works, designs)
- protected by patents , copyrights, trademarks to encourage innovation
- unauthorized use can lead to legal action
Legal Information
Data related to legal proceedings, contracts, regulatory compliance
- requires high-level protection for client confidentiality and legal privilege
Financial Information
Data related to financial transactions like sales records, tax documents, bank statements
- Targeted by cyber criminals for fraud and identity theft
- subject to PCI DSS (Payment Card Industry Data Security Standard)
Human-Readable Data
Understandable directly by humans (text documents, spreadsheets)
Non-Human-Readable Data
Requires machine or software to interpret
- Binary code
- machine language
Contains sensitive information and requires protection
Data Sovereignty
Digital information subject to laws of the country where its located
- Gained importance with cloud computing’s global data storage
General Data Protection Regulation (GDPR)
Protects EU citizens’ data within EU and EEA borders
- compliance required regardless of data location
- non-compliance leads to significant fines
Data Sovereignty Laws (ex: Chine/Russia)
Require data storage and processing within national borders
- challenge for multinational companies and cloud services
- pose complex challenges
Access Restrictions
Cloud services may restrict access from multiple geographic locations
Geographic Restrictions (Geofencing)
Virtual boundaries to restrict data access based on location
- compliance with data sovereignty laws
- prevent unauthorized access from high risk locations
Encryption
Transform plaintext into cipher text using algorithms and keys
- protects data at rest and in transit
- requires decryption key for data recovery
Hashing
Converts data into fixed-size hash values
- Irreversible one-way function
- commonly used for password storage
Masking
Replace some or all data with placeholders (ex: “x”)
- partially retains metadata for analysis
- irreversible de-identification method
Tokenization
Replacing sensitive data with non-sensitive tokens
- original data stored securely in a separate database
- often used in patient processing for credit card protection
Obfuscation
Make data unclear or unintelligible
- Various techniques, including encryption, masking, and pseudonyms
- hinder unauthorized understanding
Segmentation
Divide network into separate segments with unique security controls
- prevent lateral movement in case of a breach
- limits potential damage
Permission Restrictions
Define data access and actions through ACLs (Access Control Lists) and RBACs (Role-Based Access Controls)
Data Loss Prevention (DLP)
Aims to monitor data in use, in transit, or at rest to detect and prevent data theft
- DLP systems are available as software or hardware solutions
Endpoint DLP System
Installed as software on workstations or laptops
- Monitors data in use on individual computers
- Can prevent or alert on file transfers based on predefined rules
Network DLP System
Software or hardware placed at the network perimeter
- Focuses on monitoring data entering and leaving the network
- Detects unauthorized data leaving the network
Storage DLP System
Installed on a server in the data center
- inspects data at rest, especially encrypted or watermarked data
- monitors data access patterns and flags policy violations
Cloud-Based DLP System
Offered as a software-as-a-service solution
- protects data stored in cloud services
