Data Protection

Question 1

Sensitive Data

Answer 1

Any information that can result ina aloss of security or a loss of advantage to a company if accessed by an unauthorized person.

Question 2

Public Data

Answer 2

Has no impact on the company if released and is often posted in an open-source environment

Question 3

Private Data

Answer 3

Contains data that should only be used within the org

Question 4

Confidential Data

Answer 4

Contains items such as trade secrets, intellectual property data, and source code that affect the business if disclosed.

Question 5

Critical

Answer 5

Contains valuable information

Question 6

What are the government classifications?

Answer 6

Unclassified
Sensitive but Unclassified
Confidential (serious effect)
Secret (Serious Damage)
Top Secret

Question 7

Data Owner

Answer 7

Senior executive role that has the responsibility for maintaining the CIA of the asset.

Question 8

Data Controller

Answer 8

Entity that holds responsibility for deciding the purposes + methods of data storage, collection, and usage, and for guaranteeing the legality of processes.

Question 9

Data Processor

Answer 9

A group of individuals hired by the data controller to help with tasks like collecting, storing, or analyzing data.

Question 10

Data steward

Answer 10

Focused on the quality of the data and the associated metadata

Question 11

Data Custodian

Answer 11

Responsible for handling the management of the system on which the data assets are stored

Question 12

Privacy Officer

Answer 12

Role that is responsible for the oversight of any kind of privacy-related data like PHI, PII, or SPI

Question 13

How to Protect Data at Rest

Answer 13

Full disk encryption (FDE)
Partition Encryption
File Encryption
Volume encryption
Database encryption
Record encryption

Question 14

How to Protect Data in Motion

Answer 14

Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
Virtual Private Network (VPN)
Internet Protocol Security (IPSec)

Question 15

Data Sovereignty

Answer 15

Refers to the concept that digital information is subject to the laws of the country in which it is located.
The principle is that information is subject to the nation’s laws where it is collected or processed.

Question 16

What options are there for securing data?

Answer 16

Geographical Restrictions (Geofencing) -Virtual Boundaries to restrict access based on location

Encryption - Transforms readable data into ciphertext using an algorithm and encryption key.

Hashing - Converts data into a fixed size of numerical or alphanumeric characters, known as a hash value. Used for sensitive data, like passwords.

Masking - involves replacing some or all the data in a field with a placeholder such as “X” to cancel the original content.

Tokenization - Replaces sensitive data with non-sensitive substitutes, known as tokens.

Obfuscation - Involves making data unclear or unintelligible, making it difficult for unauthorized users to understand.

Segmentation - involves dividing a network into separate segments, each with its security controls.

Permission Restrictions - This involves defining who has access to specific data and what they can do with it.