Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Concepts in Data Management > Data Protection and Security > Flashcards

Data Protection and Security Flashcards

1
Q

Why is ethical data management important?

A
  • Technologies moves faster than legislation
  • Understanding ethical concerns that form the basis of legislation ensures privacy, freedom and autonomy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the ethical principles of data management?

A
  • Transparency
  • Fairness
  • Privacy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who should be clear about what data is collected and why it is collected?

A
  • Data Subject
  • Data Handler
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a Data Subject?

A

The person whose data is stored or processed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Policies should be…

A
  • Clearly written
  • Available
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Privacy policies should be set as….

A

Default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is needed to collect additional data?

A

Data Subject’s consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Should an organisation follow certification schemes for data protection?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What do you need to make clear if you are using automated decision making?

A

The ethical aspects that have been considered in the decision to avoid discrimination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does fairness mean with respect to ethical principles?

A

Considering the impact of data handling on people and their interests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Personal data use should be [BLANK] for all involved parties

A

Fair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

True or False: Misuse should be avoided

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

True or False: Impact of Failures does not need to be considered

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What sensitive data is not allowed to be used in automated decision making?

A
  • Race
  • Religion
  • Political preference
  • Sexual Orientation
  • Disability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Data should only be used in the [BLANK] the user has consented to.

A

Context

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

True or False: Users should be able to correct their data

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does respect mean with regards to ethical considerations?

A

The consideration for data subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following should data managers prioritise:
* The interests of the data subject
* The benefits for the organisation deriving value from the data

A

The interests of the data subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is unethical data handling?

A
  • The rights of the individual are harmed
  • The individual loses control of their data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What should be collected from an individual for specific use of data

A
  • Consent
  • Authorisation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Why is Big Data a concern for ethical data management?

A
  • Data is aggregated from different sources
  • Data is linked to provide enriched information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are concerns in Big Data?

A
  • Inappropriate data sharing
  • Idenfication of individuals
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is inappropriate data sharing?

A

Sharing personal data with third parties without the consent of the data subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is data anonymisation?

A

Applying privacy-preserving transformation to data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Do any further measures need to be applied to anonymised data to comply with data protection rules?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Is data anonymisation a foolproof solution?

A

No, the identity can still be inferred from other data characteristics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How is the identification of individuals a concern in Big Data?

A

When used with data profiling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is profiling?

A
  • Correlations in data that can be used to identify a data subject
  • Identifying a data subject as a member of a group or category
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What data mining techniques does profiling use?

A
  • Descriptive data mining
  • Predictive data mining
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is descriptive data mining?

A

Creating profiles from groupings discovered by the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the outcome from descriptive data mining?

A

Descriptions of characteristics and relationships for the discovered groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is predictive data mining?

A

Using labelled data to learn relationships between characteristics and class membership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What do predictive data mining models predict?

A

Membership of a group with a given certainty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

When might predictive profiling be used?

A
  • Recommender systems
  • Personalised services
  • Anomaly detection systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the risks associated with profiling and data mining?

A
  • Discrimination
  • De-individualisation
  • Information asymmetry
  • Unfair treatment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is discrimination in profiling?

A
  • Models trained with biased data
  • Model exhibits discrimination
  • Results used in a discriminate way
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is de-individualisation?

A

Applying all group characteristics to an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is information asymmetry?

A
  • Upsetting the balance of power between government and citizens or businesses and customers
  • May lead to denying service due to a profile-based decision (e.g denying credit)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is unfair treatment with relation to profiling?

A
  • May stigmatise indivuals / negatively affect social ties
  • Individuals may not share all group characteristics and should not be treated as though they do
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

True or False: Decisions made by profiling algorithms may not be explainable

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What should profiling data models exclude to avoid disccrimination

A

Sensitive data such as gender, race or political beliefs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What are risks associated with revealing Personal Identification Information online?

A
  • Social engineering
  • Phishing
  • Identity theft
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the most common platform that people reveal Personal Identification Information on?

A

Social media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are the risks of revealing location information?

A
  • Stalking
  • Demographic re-identification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What is demographic re-identification?

A
  • Sharing information such as location, gender and date of birth which leads to narrow identification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Why do data aggregation companies threaten privacy?

A
  • Collect data available online or on social profiles
  • Sell this onto third parties such as insurance or rating companies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is public surveillance?

A

Government agents using online information, video or or data to surveil individials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What rights does public surveillance harm?

A
  • Right to privacy
  • Autonomy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Where do IoT devices face more cybersecurity threats?

A

When they are out in the open rather than under physical control of system administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What are the risks associated with limited access to technology?

A
  • Underrepresentation of certain groups
  • Partial, incorrect or non-representative data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is discrimination by algorithm?

A

Automated decisions resulting in unfair treatment on an individual based on a protected characteristic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Why might discrimination by algorithm occur?

A

Bias or predjudice is present in the training data, which is then replicated by the trained model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

True or False: Real world data is likely biased as information on the internet comes from external sources

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What are methods of best practice for avoiding discrimination by algorithm?

A
  • Using unbiased training data
  • Paying attention to class balance
  • Using adequate feature selection for minority groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Why do we have data protection principles?

A

Protect personal data from collection and processing by third parties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are the origins of data protection principles?

A

Universal human rights

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are examples of regional data protection laws?

A
  • Singapore Personal Data Protection Act
  • Indian Data Protection Act
  • Privacy Framework of the Asia-Pacific Economic Cooperation (APEC)
  • General Data Protection Regulation (GDPR)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

When did GDPR first come into effect?

A

May-18

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is GDPR?

A

A framework for the protection and privacy of data during data collection, storage and processing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What does GDPR apply to?

A

Any information relating to an individual or identifable individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What are the roles defined by GDPR?

A
  • Data Subject
  • Data Controller
  • Data Processor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What does a data controller do?

A
  • Holds collected data
  • Defines how data is collected and processed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What does a data processor do?

A

Collects and processes data on behalf of data controllers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

How many principles are in GDPR?

A

Seven

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are the seven GDPR principles?

A
  • Lawfulness
  • Data Minimisation
  • Confidentiality
  • Accuracy
  • Accountability
  • Storage Limitations
  • Purpose Limitations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What else does Lawfulness encompass in GDPR?

A
  • Fairness
  • Transparency
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are accepted legal grounds for collecting data?

A
  • Consent
  • Public interest
  • Legitimate interest
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is needed when sensitive data is collected?

A

Explicit consent from the data subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is legitimate interest?

A

Collecting data for legal purposes or to fulfil admin obligations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What does handling data with fairness mean?

A

Data should be handled in a fair and reasonable fashion from the perspective of the data subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What does Purpose Limitation mean in GDPR?

A
  • Data is only stored and processed in line with legitimate and clearly specified purposes
    *Other storage and process must not be carried out
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is Data Minimisation in GDPR?

A

Data should be:
* Appropriate
* Relevant
* Limited
* Indispensible

for meeting the purposes of collection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What should be defined before the data collection process begins?

A

The minimum amount of data required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What does Accuracy mean according to GDPR?

A

Ensuring information is accurate and up to date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

According to GPDR, who is responsible for ensuring data is accurate?

A
  • Data Controller
  • Data Handler
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What does GDPR obligate an organisation to do if a data subject says their information is outdated?

A

Rectify the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is Storage Limitation according to GDPR?

A
  • Keeping data for only as long as is necessary
  • Ideally automating any deletion or anonymisation processes
78
Q

According to GDPR, what should a Storage Limitation policy define?

A
  • How long data is kept for
  • When data is deleted or anonymised
79
Q

What does the Confidentiality principle of GDPR cover?

A
  • Requirements for data controllers and data processors to maintain data security
  • All information must be treated as sensitive
  • Data integrity must be protected
80
Q

What must data controllers and processors protect against?

A

Unauthorised or unlawful:
* Access
* Processing
* Loss
* Destruction
* Damage

81
Q

What does Accountability mean in GDPR?

A

The responsibility of the data controller to comply with GDPR

82
Q

When can exceptions be made to GDPR?

A
  • Where set out in union or member state law
  • When justified in the public interest (eg for public health or safety)
  • When based on legitimate interest
83
Q

What is the “Right of information”?

A

Knowledge of which personal data are collected and processed

84
Q

What is the “Right to know the source of personal data”?

A

Data controllers must tell data subjects about which data processors are collecting and processing their data and if a third party is involved.

85
Q

What is the “Right of access”?

A

Data subjects can ask for a copy of their personal data

86
Q

What is the “Right to rectification”?

A

Data subjects can request corrections to data

87
Q

What is the “Right to erasure”?

A
  • Also known as the “right to be forgotten”
  • Individuals can request deletion of personal data
88
Q

What is the “Right to object processing”?

A
  • Individuals can object to processing
  • This means the data controller needs to stop processing the data
89
Q

What is the “Right to restrict processing”?

A
  • Refers to processing constraints
    *If there is a claim about the correctness of data, the data can request restriction of data processing while the claim is resolved
90
Q

What is the “Right to be notified”?

A

Data subjects must be notified of:
* Further data processing
* Deletion of data
* Breaches or unauthorised data access

91
Q

What is the “Right to data portability”?

A
  • Enables free flow of data
  • Individuals can request their data in a portable format (where feasible)
92
Q

What is the “Right to not be subject to profiling”?

A
  • Before automated decision making processes are put into place, data controllers must carry out a Data Impact Assessment to asses privacy-related risks
  • Automated decisions require explicit consent from the individual (except where required by law, eg tax fraud detection)
    *Data subjects have the right to receive information about the logic of the automated decision making process
93
Q

What should data systems be designed to do?

A

Minimise risk in the event of a data breach

94
Q

How might a data system minimise risk in the event of a data breach?

A
  • Anonymise data
  • Restict collected data to only absolutely necessary data
95
Q

What two principles does GDPR define in relation to data security?

A
  • Data protection by design
  • Data protection by default
96
Q

What is data protection by design?

A

Implementing data protection principles into the system from the first stage of development

97
Q

What is data protection by default?

A

The highest possible data security settings should be the default setting for the whole system

98
Q

What does a data controller need to ensure that a processing system has?

A
  • Confidentiality
  • Integrity
  • Availability
  • Resilience
99
Q

What measures might be implemented within a data system to enqure security and reliability?

A
  • Strong access controls
  • Effective restoring mechanism in the event of technical incidents
  • Protecting servers against external threats
  • Closed systems for data processing
100
Q

What techniques should data controllers implement to secure data?

A
  • Anonymisation
  • Pseudonymisation
  • Encryption
101
Q

What is anonymisation?

A
  • A technique to remove Personal Identification Information (PII)
  • Aims to remove personal data so that it is extremely unlikely that individuals can be re-identified
102
Q

What situations is anonymisation used for?

A
  • Data sharing
  • Data analysis of sensitive data
  • Using data for other purposes
103
Q

What are the four categories of attributes that need to be treated differently in relation to anonymisation?

A
  • Explicit identifiers
  • Quasi-identifiers
  • Sensitive information
  • Non-sensitive information
104
Q

What are explicit-identifiers?

A
  • attributes that directly identify an individual
  • such as full name, email address
105
Q

What are quasi-identifiers?

A
  • Attributes that do not individually identify an individual but might if used in combination
  • such as postcode, gender, data of birth
106
Q

What is sensitive information?

A
  • Private information that must not be revealed
  • such as health or financial information, political beliefs, sexual orientation
107
Q

What is non-sensitive information?

A
  • Information with no link to an individual
  • such as climate data
108
Q

What is re-identification?

A

Reconstructing sensitive data from anonymised data

109
Q

What models are available to anonymise data?

A
  • K-Anonymity
  • Differential privacy
  • T-Closeness
  • L-Diversity
110
Q

What methods are available to anonymise data?

A
  • Suppression of attributes
  • Generalisation of attributes
  • Permutation of attributes
  • Preturbation of attributes
111
Q

What is the effect of the information and utility loss of data caused by anonymisation?

A

Minor to negligible impact on the results, depending on context.

112
Q

What is pseudonymisation?

A

The process of replacing Personal Identification Information with random identifiers

113
Q

What does pseudonymisation use to track the substitution of data with random identifiers?

A

A linkage table

114
Q

Why is pseudonomysed data able to be used for data analysis?

A

It does not contain any Personal Identification Information

115
Q

How can reidentification be carried out on pseudonomysed data?

A

By using the linkage table to retrieve the individual’s identity

116
Q

What are the key considerations when using data in scientific research?

A
  • Data integrity and confidentiality (large amounts of sensitive data)
  • Data quality (critical for achieving reliable research results)
117
Q

What are the two approaches to comply with GDPR in scientific research

A
  • Obtain broad consent (difficult to specify future use cases)
  • Anonymise personal information in the data (complete anonymisation impossible due to links to other genomic information)
118
Q

How does GDPR describe anonymity?

A
  • A technique to prevent identification by reasonable or “appropriate” means
  • Appropriate is never clearly defined so open to interpretation
119
Q

What protection does encryption provide?

A
  • Protects confidentiality
  • Protects data integrity
120
Q

How does encryption protect data?

A

Converts data into ciphertext which is unreadable for unauthorised users

121
Q

How is ciphertext decipherd?

A

Using a password or secret key held by authorised users

122
Q

What is encryption at rest?

A

Encryption applied to archived datasets

123
Q

What is encryption in transit?

A

Encryption applied to data being transferred over a network

124
Q

What are the different types of encryption techniques?

A
  • Symmetric encryption
  • Asymmetric Encryption
  • Quantum Encryption
  • Homophoric Encryption
125
Q

What is symmetric encryption?

A

Uses the same key for encryption and decryption

126
Q

What are examples of symmetric encryption algorithms?

A
  • Data Encryption Standard (DES)
  • Advanced Encryption Standard (AES)
  • Blowfish
127
Q

What is Asymmetric encryption?

A
  • Uses a pair of public and private keys
  • Referred to as “public key cryptography”
128
Q

How are public keys and private keys used in asymmetric encryption?

A
  • Public key - encryption
  • Private key - decryption
129
Q

What are examples of asymmetric encryption algorithms?

A

*RSA (Rivest, Shamir & Adleman)
* Diffie - Hellman

130
Q

What is Elliptic Curve Cryptography?

A

A public-key cryptography approach based on the algebra of elliptic curves

131
Q

How do Hash Functions work?

A

Create a unique, fixed-length digital fingerprint of the data that can be used to verify the integrity of the data

132
Q

What are examples of cryptography hash functions?

A
  • SHA-256
  • MD-5
133
Q

What makes a hash function more secure?

A
  • The length of the key
  • This relates to the different possible combinations available
134
Q

Besides security implications, what else is important in choosing the encryption method?

A
  • The type of data being encrypted
  • Performance needs
135
Q

What are the most commonly used encryption algorithms?

A
  • AES
  • RSA
136
Q

What are key stores?

A

Secure storage and management solutions for cryptographic keys

137
Q

What are the two different types of key stores?

A
  • Hardware Security Modules
  • Cloud-based key stores
138
Q

What are hardware security modules?

A
  • Physical devices
  • Range from personal cryptographic chipsets through to hardware modules deigned for massive cryptographic operations
139
Q

What are cloud-based key stores?

A
  • Provde centralised key management and secure key storage
140
Q

What are examples of cloud-based key storage solutions?

A

*Amazon Key Management Services
* Azure Key Vault

141
Q

How does application encryption work?

A
  • Data is encrypted during transmission over the network
  • Uses SSL (Secure Socket Layer) or TLS (Transport Layer Security)
142
Q

Why is application encryption described as having a transparent approach?

A
  • Key management is performed automatically by the server
  • The user does not handle keys of encryption
143
Q

How does database encryption work?

A
  • Sensitive information is encrypted with a symmetric encryption algorithm such as AES
  • Keys are stored securely and seperately from encrypted data
144
Q

What are the different types of database encryption available?

A
  • Transparent Data Encryption (TDE)
  • Column-level Encryption
  • File-level Encryption
  • Application-level Encryption
145
Q

How does Transparent Data Encryption work?

A
  • Encrypts data at rest and in transit
    *Attaches a data encryption module which is handled by the RDBMS
146
Q

How does Column-level encryption work?

A
  • Encryption is only used as needed, which improves performance
  • Encrypts specific columns holding sensitive data
147
Q

How does File-level encryption work?

A

Encrypts individual database files on the disk such as data files, index files and backups

148
Q

Where is file-level encryption used?

A
  • Portable devices (eg laptops)
  • Cloud database
149
Q

How does application-level encryption work?

A
  • Used for highly sensitive information
  • Encrpyts data within the application before storing it in a database
  • Manages the keys and encryption process
150
Q

What is data at rest?

A

Data in tables, logs, tablespaces and backups

151
Q

What is data in transit?

A

Data retrievals over the network

152
Q

How does MongoDB encrypt data?

A
  • Encrypts data at rest
  • Supports 256-bit AES encryption
  • Uses internal encryption and external key management systems
153
Q

How does Oracle SQL Database encrypt data?

A
  • Uses Transparent Data Encryption and Advanced Security Options (ASO)
  • Uses secure key stores for network encryption and advanced authorisation
154
Q

How does MySQL encrypt data?

A
  • Encrypts data at rest
  • Uses encrypted storage engines or Keyring-file plugin
155
Q

How does AWS S3 encrypt data?

A

Uses server side encryption with Amazon S3-Managed Keys or AWS Key Management Service

156
Q

How does Microsoft Azure encrypt data?

A
  • Encrypts data at rest with Azure Storage Service Encryption
  • Encrypts data in transit with Transport Layer Security
157
Q

What open source data encryption solutions are available?

A
  • VeraCrypt
  • GnuGP
  • Dm-Crypt
  • LUKS
  • AxCrypt
  • Bitlocker
  • FileVault
  • Boxcryptor
158
Q

How does data masking work?

A
  • Substitutes original data with randomised values
159
Q

Why is data masking used?

A
  • Ensure only necessary data is exposed
  • Obfuscated data can be used without compromising privacy
160
Q

What is the difference between data encryption and data masking?

A

Data masking ensures that algorithms or other methods can’t be used to reverse engineer the data

161
Q

What are the techniques used in data masking?

A
  • Shuffling
  • Scrambling
  • Substitution
  • Data aging
  • Varience
  • Nullifying
  • Character masking
162
Q

What is shuffling in data masking?

A

Randomly reorders the values of a column

163
Q

What is scrambling in data masking?

A

Reorders the aphanumeric characters in a data value to change the value

164
Q

What is substitution in data masking?

A

Replaces the original sensitive content with other valid values

165
Q

What is important to do when data masking using substitution?

A

The replaced values must preserve the originial characteristics of the data

166
Q

What is data aging in data masking?

A
  • Modifies numerical values
  • Adds or rests a random offset
167
Q

What is data variance in data masking?

A
  • Modifies numberical values
  • Adds noise according to the data distribution
168
Q

What is nullifying in data masking?

A

Substitutes original values with null values

169
Q

What is character masking in data masking?

A
  • Substitutes part of the original value with a given character (such as asterisks)
  • Only part of the originial value remains
170
Q

What is static data masking?

A
  • A copy of the original data is made, with sensitive fields obfuscated
  • Easier to implement
  • Less flexible
171
Q

What is dynamic data masking?

A
  • Obfuscates information based on role based policies or permission settings
  • Flexibility in allowing data access
172
Q

Where is dynamic data masking used?

A

Production systems

173
Q

What are challenges of data masking?

A
  • Complicated process in large systems
  • High resource use leading to performance drops
  • Obfuscated data requires maintenance
  • Potential loss of data integrity
  • Potential sensitive data leakage if masking techniques are insufficient
174
Q

What are some solutions available for data masking?

A
  • Microsoft SQL server uses Redgate SQL data-masker
  • Oracle SQL Server uses Oracle data masking and subsetting utility
  • Commercial standalone solutions: Delphix Dynamic Platform, Information MDM, IBM Infosphere Data Privacy
  • Open source standalone solution: Talend Data Masking
175
Q

What are cloud solutions available for data masking?

A
  • AWS uses Amazon S3 Inventory, Amazon Macie, Amazon RedShift Data Management
  • Microsoft Azure uses Azure Security Centre
176
Q

Why do we have data security principles?

A

Protect sensitive data from unauthorised access, use, disclosure, modification or destruction

177
Q

What are the data security principles?

A
  • Integrity
  • Availability
  • Confidentiality
  • Authenticity
  • Non-Repudiation
  • Access Control
  • Encryption
  • Disaster Recovery
178
Q

What does the data security principle of integrity involve?

A
  • Ensuring data can’t be modified by unauthorised means
  • Checksums/Digital signatures used by databases to verify data integrity
179
Q

What does the data security principle of availability involve?

A
  • Authorised users have data access when needed
  • Data must be replicated and backups scheduled
  • Plans are made to account for network interruptions or data loss
180
Q

What does the data security principle of confidentiality involve?

A
  • Data is kept secure
  • Access is only by authorised users
  • Refers to data at rest and in transit
  • Uses encruption techniques, data masking, access control techniques
181
Q

What does the data security principle of authenticity involve?

A
  • Authenticate users to prevent unauthorised access to sensitive data
  • Includes passwords, encryption keys, biometric/multi-factor authorisation and methods for intrusion detection/prevention
182
Q

What does the data security principle of non-repudiation involve?

A
  • Registering users and applications accessing sensitive data to create an audit trail
  • Traceability
  • Uses digital signatures or time stamps to track evolution of information
183
Q

What does the data security principle of access control involve?

A
  • Restics data access to authorised users
  • Often role based to establish different access levels and who has read/write/update/delete permissions
  • When used in RDBMS can complement firewalls in blocking unauthorised access
184
Q

What does the data security principle of encryption involve?

A

Protecting data by encipohering data during transmission or storage

185
Q

What does the data security principle of disaster recovery involve?

A
  • Ability to recover and restore data
  • Creation of a disaster recovery plan with details of backup creation, secure backup storage and backup restoration
186
Q

What is risk management?

A
  • Identifying, assessing and prioritising risks
  • Setting out risk countermeasures
187
Q

What is the first step of the risk management process?

A

Carrying out a risk analysis to identify potential risks and threats

188
Q

What is the second step of the risk management process?

A

Estimating the probability of each threat and it’s potential impact. This identifies the most relevent security threats.

189
Q

What is the third step of the risk management process?

A

Developing mitigation strategies to address critical security risks

190
Q

What is the fourth step of the risk management process?

A

Monitoring the effectiveness of mitigation strategies and adapting them as needed

191
Q

What is the final step of the risk management process?

A
  • Clearly documenting the risk management plan and mitigation procedures
  • Evidencing security risks are well addressed and compliant with security regulations

Concepts in Data Management (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions