Chapter 5 Flashcards
(13 cards)
Sensitive Data Types
PII
PHI
Proprietary
PII
- distinguish individual identify
- can link to individual; financial, medical, educational, employment
PHI (health)
- created or received by health care provider, plan, employer, etc.
- past/present/future physical or mental health, provision of or payment for health care
Proprietary Data
Trade secrets, software code, internal processes, etc.
Data Classification
Gov’t:
Class 3 - Top secret - grave damage
Class 2 - Secret - serious damage
Class 1 - Confidential - damage
Class 0 - Unclassified - no damage
Organizations:
Class 3 - Confidential/Proprietary - trade secrets, IP
Class 2 - Private - PII, PHI, financial
Class 1 - Sensitive - IT info
Class 0 - Public
DLP
- Network-based
- Endpoint-based
- Cloud-based
Also includes sensitive info discovery function
Data destruction techniques
- Erasing - not secure
- Clearing/overwriting - usually for media reuse but not fully secure; some bad sectors can be skipped
- Purging - more intense clearing; several iterations of clearing plus degauss; also can’t be always trusted
- Degaussing - only for magnetic media
- Destruction - most secure
- Cryptographic erasure - destroy encryption/decryption keys of encrypted data
Declassification
Purging of classified data for re-use in non-classified env
Better to destroy
DRM (Digital Rights Mgmt)
To protect copyrighted works
- DRM license - small file with terms of use and license key
- Persistent online authentication
- Automatic expiration
- Continuous audit trail - e.g. to detect concurrent use in diff locations
CASB
- between users and cloud resources
- replicate all internal security controls
- Can detect shadow IT
Other Data Protection Methods
- Pseudonymization - replace personal data with pseudonyms (e.g. Patient123) before releasing data; may have less stringent GDPR requirements
- Tokenization - for credit card payment processing
- Anonymization - remove personal data or random masking (re-arrange rows within columns); GDPR may not apply if used; randomized masking is one method
Data Roles
- Data owner - responsible for security of data
- Asset (or system) owner - responsible for security of system processing the data
- Business owner - responsible for the business processes that use the systems and data
- Data controller - collects data; determines what, why and how data should be processed
- Data processor - process data on behalf of data controller
- Data protection officer - mandated by GDPR; ensure protection of data privacy
- Data custodian - day-to-day tasks of protecting data
- Data administrator - someone who is a data custodian or with elevated privilege
- Users - access data
- Data subjects (GDPR) - person identified by data
Security Baseline
Set of min security controls
NIST published:
- Low-impact baseline
- Moderate-impact baseline
- High-impact baseline
- Privacy-control baseline - for those orgs that process PII
Tailoring - take baseline controls and tailor to organization
Scoping - is a part of tailoring; remove controls that don’t apply
