Data Security Flashcards
Masking/ encryption will
render the data unreadable without the keys
13 guiding priciples of data security
- responsible trustee of data
- comply with regulations
- Use CRUD matrices to help map data access needs
- data security policy should be updated and approved by the data governance council (DGSC)
5.identify application security requirements on projects - classify all enterprise data for confidentiality
- Passwords show follow complexity guidlines
- security role groups
- request, track and approve all user and group authorisations
- centrally manage user identity data and group membership data
- use views or partitions to restrict access to sensitive columns or specific views
- strictly limit and consider every use of share or service user accounts
- monitor data access activity to understand trends
Classifications of data
PII, business critical financially critical
Password best practise
3/4 random words
Goldilocks Principle
balance must be met based on the damage/harm that could be caused
Four sources of data security requirements
- business needs
- government regulations
- stakeholder concerns
- legitimate business concerns
Security control legislation EU
Security control legislation EU
- EU GDPR
- BASEL II and Solvency II
- BCBS 239 Basel committee
- PCI-DSS
Security control legislation US
- HIPAA
- Sarbanes-Oxley Act
- CCPA
- CPRA
Four As
Authentication
Authorisation
Access
Audit
Sarbanes-Oxley Act
prevents unauthorised modification of financial transactions
Solvency II
Protecting lineage of data feeding risk models
Active Audit
Parsing instructions and data before its returned to the user
Passive Audit
Looking what has happened
CCPA
statute to enhance privacy right and consumer protection (california)
ISO standards
set out critical requirements for information secuirty standard in an organisation
ISO/IEC 29100
about the technology e.g. firewalls
ISO/IEC 27001
how to manage information security
ISO/IEC 27701
extension of 27001 relating to GDPR
Standards should influence
- access control
- use of devices
- disposal processes
CIA
confidentiality, integrity, availability
CIA Integrity
preventing undetectable modification of information
3 categories of controls
- Administrative controls
- Logical controls
- physical ocntrols
Administrative controls
precedural security e.g., training, policies
Logical controls
software security e.g., passwords, firewalls, encryption
Physical Controls
Workplace Security e.g., doors, locks, CCTV, sprinkler system
Risk Assessment Stages
- categorise the threats e.g., environmental vs manmade
- categorise the vulnerabilities e.g., physical, technological, human
- Probability - what’s the likelihood that a threat exploits a vulnerability
- Impact - how will this effect the organisation
- Give a suggested mitigation
How does ISO 27001 suggest to treat risks
- terminate the risk
- treat the risk
- transfer the risk
- tolerate the risk (accept the risk)
IT Security Threats: Privilege Escalation
Exploiting the bugs in software.
Mechanism that people use to load further bad software, to use it as a node for further attacks
IT Security Threat: Root kits
Activated as system boots up (hard to detect), allow the installation of files and accounts to intercept sensitive information
IT Security Treat: Ransomware
Malware that encrypts your data and payment is demanded before the data is returned
SMART
specific, measurable, achievable. realistic, timely
The planning development and execution of security policies and procedures to provide proper authentication, authorisation access and auditing of data and information assets
Data security management
HIPAA is relevant
for US healthcare providers
PCI-DSS is relevant for
online card payments
The implementation and administration of database security is the responsibility of
The DBA
Responsibility of the data governance council in defining an information security policy
review and approve the high-level data security policy
What is the benefit of using role groups to implement data security policies
reduces the effort to assign access rights to users if they inherit rights from their group
Different ways to encrypt
Hash, private key, public key & Obfuscation/masking
Two types of masking
persistent & dynamic
Persistant masking
Permanently alters the data
Persistant masking two types
in flight (moving between source and place e.g. between production and non production)
in place (when source and destination are the same)
Dynamic Masking
Changes the appearance without changing the data
Temporal variance
move dates + - a number of days (type of masking)
cookie
a small data file that is downloaded on to a computers hard drive, to identify returning visitors and profile their preferences
DMZ
The area of the edge/ perimeter of an organisation, with a firewall between it and the organisation.
One of the main approaches to managing sensitive data is classifying them and enforcing a common standard. This process is also part of:
Metadata Management
Guiding Principles for data security
- requires collaboration
- enterprise wide approach
- proactive management
Authentication
verifying the user identities of those who are accessing your data
Classifying data (important metadata)
define confidentiality levels
encrypting data at rest
encrypting data when it’s stored on a device
secure data in transit
encrypting data which its being transitted between locations
Which role is responsible for determining the right confidentiality levels
data stewards
Organisations are turning increasingly into cloud based computing environments. What are some measures needed to adapt to this new emergence?
Tweaking or creating a new data security management policy centered on cloud computing
Data security policies must account for distribution of data across different service models
ed to adhere to the same security policy as the rest of the organisation
In cloud computing, defining chain of custody of data and defining ownership and custodianship rights should be a priority
Internal cloud data-center architecture need to adhere to the same security policy as the rest of the organisation
One of the main approaches to managing sensitive data is classifying them and enforcing a common standard. This process is also part of:
Metadata Management
While the Information security team enforces and protects the network, which role is responsible for determining the right confidentiality levels?
Data stewards
