Módulo 13 - Data Protection and Compliance Flashcards
List:
Impacts of non-compliance with data protection laws
- Legal sanctions
- Financial penalties
- Legal liabilities
- Reputational damage
- Loss of customer trust
- Increased regulatory scrutiny
List:
Consequences of a data or privacy breach
- Reputation damage
- Identity theft
- Fines
- Intellectual property (IP) theft
- Escalation risks
List:
Notifications required in data breaches
- Regulator
- Law enforcement
- Affected individuals
- Third-party companies
- Public (media or social channels)
List:
Impacts of contractual non-compliance
- Breach of contract
- Termination of contracts
- Indemnification and liability
- Non-compliance penalties
List:
Forms of non-compliance with software licensing
- Exceeding permitted installations
- Unauthorized sharing
- Unauthorized usage
- Modifying code
- Distributing software without authorization
Define:
Security compliance
Adherence to standards, regulations, and practices to protect sensitive data.
Define:
Sanctions
Penalties for non-compliance with laws or rules.
Define:
Data breach
Unauthorized reading, modification, or deletion of data.
Define: Privacy breach
Loss or disclosure of personal and sensitive data.
Define:
Escalation in data breaches
Raising the issue to senior decision-makers for legal and regulatory assessment.
Define:
Indemnification in contracts
Shifting liability for damages or legal costs to another party.
Define:
Non-compliance penalties
Fines or damages stipulated in contracts for failing cybersecurity measures.
Define:
License remediation
Correcting non-compliance with software licenses.
List:
Types of regulated data
- Financial information
- Healthcare records
- Social security numbers
- Credit card details
- Personally identifiable information (PII)
List:
Types of human-readable data
- Text
- Images
- Multimedia content
- Documents
- Reports
- Emails
- Presentations
List:
Types of non-human-readable data
- Binary code
- Encrypted data
- Machine-readable formats
- Complex structured data
- Encoded information
List:
Security measures for non-human-readable data
- Encryption
- Access controls
- Intrusion detection and prevention
- Secure data exchange
- Code/application security
List:
Data classification levels based on confidentiality
- Public (unclassified)
- Confidential (secret)
- Critical (top secret)
List:
Data classification levels for government and military
- Unclassified
- Sensitive
- Confidential
- Secret
- Top Secret
- Top Secret Compartmentalized
List:
Examples of private/personal data
- Names
- Addresses
- Social security numbers
- Financial information
- Login credentials
- Biometric data
- Health records
List:
Categories of proprietary data
- Intellectual property (IP)
- Trade secrets
- Product information
- Service information
Define:
Data types
Categorization of data based on characteristics and use.
Define:
Regulated data
Data subject to legal and regulatory requirements for handling and protection.
Define:
Trade secrets
Confidential information giving a business a competitive advantage.
Define:
Human-readable data
Data easily understood by humans, such as text and images.
Define:
Non-human-readable data
Data requiring specialized software to interpret, such as binary or encrypted formats.
Define:
Data classification schema
A system to label data based on confidentiality and type.
Define:
Proprietary information
Nonpublic data owned by a company, like intellectual property.
Define:
Restricted data
Highly confidential data with stringent access controls.
Acronym:
PCI DSS
Payment Card Industry Data Security Standard
Acronym:
PII
Personally Identifiable Information
List:
Examples of privacy data
- Names
- Addresses
- Contact information
- Social security numbers
- Medical records
- Financial transactions
List:
Examples of confidential data
- Trade secrets
- Intellectual property
- Financial statements
- Proprietary algorithms
- Source code
List:
Rights of data subjects under GDPR
- Right to access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
- Right to withdraw consent
List:
Impacts of privacy laws on data inventories and retention
- Maintaining detailed records
- Identifying legal grounds for processing
- Ensuring data minimization
- Defining retention periods
- Responding to data subject requests
- Implementing robust security measures
List:
Responsibilities of data processors under GDPR
- Process data only as instructed by the controller
- Implement appropriate security measures
- Maintain confidentiality and integrity of data
- Keep records of processing activities
- Cooperate with data controllers
List:
Responsibilities of data controllers under GDPR
- Define purposes and means of processing
- Obtain consent from data subjects
- Provide privacy notices
- Implement data protection policies
- Handle data subject requests
Define:
Privacy data
Personal information linked to an individual’s identity and privacy rights.
Define:
Confidential data
Information requiring protection due to business or proprietary sensitivity.
Define:
Data controller
Entity deciding why and how personal data is processed.
Define:
Data processor
Entity processing personal data on behalf of the controller.
Define:
Data subject
Individual whose personal data is being processed.
Define:
Right to be forgotten
Data subject’s right to request deletion of personal data under certain conditions.
Define:
Data minimization
Collecting only necessary data for specific and legitimate purposes.
Define:
Data inventory
Record detailing personal data types, processing purposes, and recipients.
List:
Steps in the decommissioning process
- Data sanitization
- Reset to factory settings
- Physical destruction of components (if necessary)
- Documentation and inventory updates
List:
Methods for secure data sanitization
- Data wiping
- Degaussing
- Encryption
List:
Methods for secure data destruction
- Shredding
- Crushing
- Incinerating
- Overwriting
List:
Circumstances requiring data destruction
- End of data retention period
- Compliance with regulations (e.g., GDPR, HIPAA)
- Decommissioning storage devices
- Reducing outdated data
List:
Key concepts in asset disposal
- Sanitization
- Destruction
- Certification
List:
Steps to decommission a multifunction network printer
- Sanitize stored print jobs and documents
- Wipe network credentials and configuration data
- Perform a full factory reset
- Securely dispose of or destroy physical components
- Update asset inventory
List:
Overwriting steps for HDD sanitization
- Pass of all zeros
- Pass of all ones
- Pass in a pseudorandom pattern
Define:
Decommissioning
Process of securely retiring devices by erasing data and resetting configurations.
Define: Data sanitization
Removing sensitive information to ensure it cannot be recovered.
Define:
Data destruction
Physically or electronically eliminating data to make it irrecoverable.
Define:
Certification (in asset disposal)
Documentation verifying secure data sanitization or destruction.
Define:
Overwriting
Sanitization method replacing data with patterns of zeros, ones, and random data.
Define:
Zero filling
Overwriting method setting all bits on a drive to zero.
Acronym:
GDPR
General Data Protection Regulation
Acronym:
HIPAA
Health Insurance Portability and Accountability Act
List:
Phases of personnel management in HR
- Recruitment
- Operation
- Termination/Separation
List:
Key components of onboarding
- Secure transmission of credentials
- Asset allocation
- Training and policies
List:
Processes involved in offboarding
- Account management
- Retrieval of company assets
- Wiping personal assets of corporate data
- Changing shared credentials
List:
Topics covered in security awareness training
- Security policies and penalties for noncompliance
- Incident identification and reporting
- Data handling and confidentiality
- Password and account management
- Social engineering and malware threats
- Secure software usage
List:
Security training methods
- Workshops
- One-on-one mentoring
- Computer-based training (CBT)
- Videos and blogs
- Simulations
- Gamification
List:
Security awareness training lifecycle stages
- Assessing needs and risks
- Planning and designing activities
- Developing materials
- Delivering training
- Evaluation and feedback
- Reinforcement
- Monitoring and adaptation
List:
Examples of risky behaviors
- Clicking on suspicious links
- Visiting untrusted websites
- Downloading unauthorized software
- Sharing credentials
- Ignoring software updates
List:
Techniques to detect anomalous behavior
- Network intrusion detection
- User behavior analytics
- System log analysis
- Fraud detection
Define:
Acceptable Use Policy (AUP)
Guidelines for proper use of organizational equipment and resources.
Define:
Onboarding
Welcoming and equipping new employees or contractors with tools and training.
Define:
Offboarding
Process ensuring employees or contractors leave without retaining access or assets.
Define:
Clean desk policy
Work areas must be free of documents to protect sensitive information.
Define:
Anomalous behavior
Actions or patterns deviating from normal expectations.
Define:
Gamification
Using game-like elements in training to improve engagement and learning.
Define:
Phishing simulation
Simulated attacks to train employees to recognize and respond to phishing.
Define:
Shadow IT
Unauthorized use of personal software or services in the workplace.
List:
States of data for protection measures
- Data at rest
- Data in transit (or motion)
- Data in use
List:
Components of Data Loss Prevention (DLP)
- Policy server
- Endpoint agents
- Network agents
List:
Typical remediation mechanisms in DLP
- Alert only
- Block
- Quarantine
- Tombstone
List:
Approaches to maintain data sovereignty compliance
- Data localization using local datacenters
- Contractual agreements with vendors
- Location-specific cloud storage facilities
List:
Geographic access requirement impacts
- Data storage locations and sovereignty
- Constraint-based access controls
- Data replication and dispersion
- Jurisdiction-specific legal requirements for forensics
List:
Benefits of a data retention policy
- Reduced discovery costs during litigation
- Reduced exposure to potential litigation risks
- Lower hardware/software requirements for old data
- Protection from evidence destruction accusations
List:
Data retention best practices
- Delete emails after 90 days
- Retain tax-related information for seven years
- Keep employee records for four years post-employment
- Retain research/patents for 25 years
- Keep vendor contracts for five years post-expiration
- Delete employee files after one year
Define:
Data protection
Measures to secure data from unauthorized access, loss, or misuse.
Define:
Compliance
Adherence to legal, regulatory, and industry requirements.
Define:
Data at rest
Data stored on persistent media, like databases or files.
Define:
Data in transit
Data transmitted over a network.
Define:
Data in use
Data present in volatile memory or being processed.
Define:
Data sovereignty
Jurisdictional control over data storage and processing.
Define: DLP policy server
Configures classification and privacy rules, logs incidents, and compiles reports.
Define:
Tombstone (DLP)
Replaces a quarantined file with a notice about the policy violation.
Define:
Data retention policy
Defines how long data is retained and procedures for archiving or destruction.
Define:
Due diligence in data protection
Assessing and verifying the adequacy of security and compliance practices.
