Data Protection Flashcards
Based on the value to the organization and the sensitivity of the information, determined by the data owner
Data Classification
Information that, if accessed by unauthorized persons, can result in the loss of security or competitive advantage for a company
Over classifying data leads to protecting all data at a high level
Sensitive Data
Why is Data Classification Important?
■ Helps allocate appropriate protection resources
■ Prevents over-classification to avoid excessive costs
■ Requires proper policies to identify and classify data accurately
What are the Commercial Business Classification Levels?
Public Data (No impact if released)
Sensitive (Minimal Impact if released ex. financial data)
Private (Contains internal personnel or salary info)
Confidential (Holds trades secrets, intellectual property, code, etc)
Critical (Extremely valuable and restricted info)
What are the Govermnet Classification Levels?
Unclassified (Generally releasable to public)
Sensitive but Unclassified (includes medical records, personnel files)
Confidential (Contains info that could affect the goverment)
Secret (Holds data like military deployment plans, defensive postures)
Top Secret (Highest level, includes highly sensitiv national security info)
Process of identifying the individual responsible for maintaining the
confidentiality, integrity, availability, and privacy of information assets
Data Ownership
A senior executive responsible for labeling information assets and ensuring they are protected with appropriate controls
Data Owner
Entity responsible for determining data storage, collection, and usage purposes and methods, as well as ensuring the legality of these processes
Data Controller
A group or individual hired by the data controller to assist with tasks like data collection and processing
Data Processor
Focuses on data quality and metadata, ensuring data is appropriately labeled and classified, often working under the data owner
Data Steward
Responsible for managing the systems on which data assets are stored, including enforcing access controls, encryption, and backup measures
Data Custodian
Oversees privacy-related data, such as personally identifiable information (PII), sensitive personal information (SPI), or protected health information (PHI), ensuring compliance with legal and regulatory frameworks
Privacy Officer
Data Owner Responsibility
The IT department (CIO or IT personnel) should not be the data owner; data owners should be individuals from the business side who understand the data’s content and can make informed decisions about classification
Selection of Data Owners
Data owners should be designated within their respective departments based on their knowledge of the data and its significance within the organization
Data stored in databases, file systems, or storage systems, not actively moving
Data at Rest
Data at Rest - Encryption Methods
Full Disk Encryption (FDE) - entire hard drive
Partition Encryption - Specific Partitions
File Encryption - individual files
Volume Encryption - selected files/directories
Database Encryption - database column,row, or table
Record Encryption - speicific fields within a database
Data actively moving from one location to another, vulnerable to interception
Data in Transit (Data in Motion)
Data in Transit - Transport Encryption Methods
SSL (Secure Sockets Layer)
TLS (Transport Layer Security)
VPN (VIrtual Private Network)
IPSec (Internet Protocol Security)
Data actively being created, retrieved, updated, or deleted
Data in Use
Data in Use - Protection Measures
Encryption at Application Level
Access Controls
Secure Enclaves
Machanisms like INTEL Software Guard
Information controlled by laws, regulations, or industry standards
Compliance requirements
● General Data Protection Regulation (GDPR)
● Health Insurance Portability and Accountability Act (HIPAA)
Regulated Data
Information used to identify an individual (e.g., names, social security numbers, addresses)
Targeted by cybercriminals and protected by privacy laws
PII (Personal Identification Information)
Information about health status, healthcare provision, or payment linked to a specific individual
Protected under HIPAA
PHI (Protected Health Information)
Confidential business information giving a competitive edge (e.g., manufacturing processes, marketing strategies, proprietary software)
Legally protected; unauthorized disclosure results in penalties
Trade Secrets
