Section 5.5 Privacy and Sensitive data concepts in relation to security

Question 1

What concept relates to the control one has over their Personal Identifiable Information (PII) and it’s use and handling?

Answer 1

Privacy

Question 2

What concept relates to how Personal Identifiable Information (PII) is protected?

Answer 2

Security

Question 3

What report shows the cost of data breaches and how security controls affected those losses?

Answer 3

Cost of a Data Breach Report

Question 4

What report is used during the risk assessment process to assess the impact to the organization of a breach of private or sensitive data to better understand the ramifications and help justify the measures to protect it?

Answer 4

Privacy Impact Assessment (PIA)

Question 5

The potential impact is ________ if the loss of confidentiality, integrity, or availability could be expected to have limited adverse effects on organizational operations, organizational assets, or individuals.

Answer 5

Low

Question 6

The potential impact is _________ if the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

Answer 6

Moderate

Question 7

The potential impact is _________ if the loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

Answer 7

High

Question 8

Notification of breaches can be costly due to what?

Answer 8

The number of people that have to be notified, either for decision making (upper management, stakeholders…) or for being affected (customers)

Question 9

What chooses the security that is associated with data?

Answer 9

The type of data

Question 10

What data type is any information, regardless of form or format, that an organization, discloses, disseminates, or makes available to the public?

Answer 10

Public Data

Question 11

What data type is all information that is not meant to be publicly disclosed or disseminated?

Answer 11

Private Data

Question 12

What data type is information that is privileged and requires special access to view or process?

Answer 12

Sensitive Data

Question 13

What data type is information subject to restricted access, whether regarding and individual or a company. Used interchangeably with sensitive data?

Answer 13

Confidential Data

Question 14

What data type is information whose loss, misuse, disclosure, unauthorized access, or modification would have a debilitating impact on the organization?

Answer 14

Critical Data

Question 15

What data type is information that, if disclosed, could harm a business’s interests, often through loss of a corporate advantage?

Answer 15

Proprietary Data

Question 16

What do you call information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual?

Answer 16

Personally Identifiable Information (PII)

Question 17

Organizations used DLP tools across an enterprise for what?

Answer 17

to minimize the ways in which private and sensitive data are extracted

Question 18

What do you call the process of reducing sensitive or private data to only what is needed?

Answer 18

Data minimization

Question 19

What do you call the process of using privacy enhancing technologies to make the data anonymous?

Answer 19

Anonymization

Question 20

What do you call the process of using privacy enhancing technologies to obfuscate the data?

Answer 20

Data Masking

Question 21

What do you call the process of using privacy enhancing technologies to substitute tokens in lieu of the data itself?

Answer 21

Data Tokenization

Question 22

Who’s job is it to set the policies and procedures for the handling and dissemination of data. They also approve how the data is connected in any way.

Answer 22

Data Steward

Question 23

Who’s job is it to determine what data will be collected and how it is used?

Answer 23

Data Controller

Question 24

Who’s job is it to process the data in accordance to the Data controller’s requirements?

Answer 24

Data Processer

Question 25

Who is responsible for ensuring that there is a data privacy strategy and that it’s implementation meets requirements?

Answer 25

Data Protection Officer

Question 26

The first step to preventing a breach of private or sensitive data is to what?

Answer 26

Catalog the data, how it’s processed, and where it’s stored.