Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security+ 701 > Data Protection > Flashcards

Data Protection Flashcards

1
Q

Based on the value to the organization and the sensitivity of the information, determined by the data owner

A

Data Classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information that, if accessed by unauthorized persons, can result in the loss of security or competitive advantage for a company

Over classifying data leads to protecting all data at a high level

A

Sensitive Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why is Data Classification Important?

A

■ Helps allocate appropriate protection resources
■ Prevents over-classification to avoid excessive costs
■ Requires proper policies to identify and classify data accurately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the Commercial Business Classification Levels?

A

Public Data (No impact if released)
Sensitive (Minimal Impact if released ex. financial data)
Private (Contains internal personnel or salary info)
Confidential (Holds trades secrets, intellectual property, code, etc)
Critical (Extremely valuable and restricted info)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the Govermnet Classification Levels?

A

Unclassified (Generally releasable to public)
Sensitive but Unclassified (includes medical records, personnel files)
Confidential (Contains info that could affect the goverment)
Secret (Holds data like military deployment plans, defensive postures)
Top Secret (Highest level, includes highly sensitiv national security info)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Process of identifying the individual responsible for maintaining the
confidentiality, integrity, availability, and privacy of information assets

A

Data Ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A senior executive responsible for labeling information assets and ensuring they are protected with appropriate controls

A

Data Owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Entity responsible for determining data storage, collection, and usage purposes and methods, as well as ensuring the legality of these processes

A

Data Controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A group or individual hired by the data controller to assist with tasks like data collection and processing

A

Data Processor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Focuses on data quality and metadata, ensuring data is appropriately labeled and classified, often working under the data owner

A

Data Steward

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Responsible for managing the systems on which data assets are stored, including enforcing access controls, encryption, and backup measures

A

Data Custodian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Oversees privacy-related data, such as personally identifiable information (PII), sensitive personal information (SPI), or protected health information (PHI), ensuring compliance with legal and regulatory frameworks

A

Privacy Officer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Data Owner Responsibility

A

The IT department (CIO or IT personnel) should not be the data owner; data owners should be individuals from the business side who understand the data’s content and can make informed decisions about classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Selection of Data Owners

A

Data owners should be designated within their respective departments based on their knowledge of the data and its significance within the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Data stored in databases, file systems, or storage systems, not actively moving

A

Data at Rest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data at Rest - Encryption Methods

A

Full Disk Encryption (FDE) - entire hard drive
Partition Encryption - Specific Partitions
File Encryption - individual files
Volume Encryption - selected files/directories
Database Encryption - database column,row, or table
Record Encryption - speicific fields within a database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Data actively moving from one location to another, vulnerable to interception

A

Data in Transit (Data in Motion)

18
Q

Data in Transit - Transport Encryption Methods

A

SSL (Secure Sockets Layer)
TLS (Transport Layer Security)
VPN (VIrtual Private Network)
IPSec (Internet Protocol Security)

19
Q

Data actively being created, retrieved, updated, or deleted

A

Data in Use

20
Q

Data in Use - Protection Measures

A

Encryption at Application Level
Access Controls
Secure Enclaves
Machanisms like INTEL Software Guard

21
Q

Information controlled by laws, regulations, or industry standards

Compliance requirements
● General Data Protection Regulation (GDPR)
● Health Insurance Portability and Accountability Act (HIPAA)

A

Regulated Data

22
Q

Information used to identify an individual (e.g., names, social security numbers, addresses)

Targeted by cybercriminals and protected by privacy laws

A

PII (Personal Identification Information)

23
Q

Information about health status, healthcare provision, or payment linked to a specific individual

Protected under HIPAA

A

PHI (Protected Health Information)

24
Q

Confidential business information giving a competitive edge (e.g., manufacturing processes, marketing strategies, proprietary software)

Legally protected; unauthorized disclosure results in penalties

A

Trade Secrets

25
Q

Creations of the mind (e.g., inventions, literary works, designs)

Protected by patents, copyrights, trademarks to encourage innovation

Unauthorized use can lead to legal action

A

Intellectual Property (IP)

26
Q

Data related to legal proceedings, contracts, regulatory compliance

Requires high-level protection for client confidentiality and legal privilege

A

Legal Information

27
Q

Data related to financial transactions (e.g., sales records, tax documents, bank statements)

Targeted by cybercriminals for fraud and identity theft

Subject to PCI DSS (Payment Card Industry Data Security Standard)

A

Financial Information

28
Q

Understandable directly by humans (e.g., text documents, spreadsheets)

A

Human-Readable Data

29
Q

Requires machine or software to interpret (e.g., binary code, machine language)

Contains sensitive information and requires protection

A

Non-Human-Readable Data

30
Q

Digital information subject to laws of the country where it’s located

Gained importance with cloud computing’s global data storage

A

Data Sovereignty

31
Q

Protects EU citizens’ data within EU and EEA borders

Compliance required regardless of data location

Non-compliance leads to significant fines

A

GDPR (General Data Protection Regulation)

32
Q

Require data storage and processing within national borders

Challenge for multinational companies and cloud services

A

Data Sovereignty Laws (e.g., China, Russia)

33
Q

Virtual boundaries to restrict data access based on location

Compliance with data sovereignty laws

Prevent unauthorized access from high-risk locations

A

Geographic Restrictions (Geofencing)

34
Q

Transform plaintext into ciphertext using algorithms and keys

Protects data at rest and in transit

Requires decryption key for data recovery

A

Encryption

35
Q

Converts data into fixed-size hash values

Irreversible one-way function

Commonly used for password storage

A

Hashing

36
Q

Replace some or all data with placeholders (e.g., “x”)

Partially retains metadata for analysis

Irreversible de-identification method

A

Masking

37
Q

Replace some or all data with placeholders (e.g., “x”)

Partially retains metadata for analysis

Irreversible de-identification method

A

Tokenization

38
Q

Make data unclear or unintelligible

Various techniques, including encryption, masking, and pseudonyms

Hinder unauthorized understanding

A

Obfuscation

39
Q

Divide network into separate segments with unique security controls

Prevent lateral movement in case of a breach

Limits potential damage

A

Segmentation

40
Q

Define data access and actions through ACLs or RBAC

Restrict access to authorized users

Reduce risk of internal data breaches

A

Permission Restrictions

41
Q

Aims to monitor data in use, in transit, or at rest to detect and prevent data theft

are available as software or hardware solutions

A

Data Loss Prevention (DLP)

42
Q

Types of DLP (Data Loss Prevention) Systems

A

Endpoint DLP System
Network DLP System
Storage DLP System
Cloud-Based DLP System

Security+ 701 (28 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions