Data Protection Flashcards
(48 cards)
Data protection
Safeguarding information from corruption, compromise, or loss
Data Classification
Based on the value to organization and the sensitivity of the information, determined by the data owner
- Sensitive
- Confidential
- Public
- Restricted
- Private
- Critical
Sensitive data
Information that, if accessed by unauthorized persons, can result in the loss of security or competitive advantage for a company
- over classifying data leads to protecting data at a high level
Importance of data classification
- Helps allocate appropriate protection resources
- Prevents over-classification to avoid excessive costs
- Requires proper policies to identify and classify data accurately
Commercial Business Classification Levels
Public - No impact if released; often publicly accessible data
Sensitive - Minimal impact if released (ex: financial data)
Private - Contains internal personnel or salary information
Confidential - Holds trade secrets, intellectual property, source code, etc
Critical - Extremely valuable and restricted information
Government Classification Levels
Unclassified - Generally releasable to the public; can be released under the Freedom of Information Act
Sensitive, but unclassified - Includes medical records, personnel files, etc. ; no harm to national security
Confidential - Contains information that could affect the government (ex: trade secrets)
Secret - Holds data like military deployment plans, defensive postures
Top Secret - Highest level, highly sensitive national security information
Data Ownership
Process of identifying the individual responsible for maintaining the confidentiality, integrality, availability, and privacy of information assets
Data Owner
a senior executive responsible for labeling information and ensuring they are protected with appropriate controls
Data Controller
Entity responsible for determining data storage, collection, and usage purposes and methods, as well as ensuring the legality of these processes
Data processor
a group or individual hired by the data controller to assist with tasks like data collection and processing
Data Steward
Focuses on data quality and metadata, ensuring data is appropriately labeled and classified, often working under the data owner
Data Custodian
Responsible for managing the systems on which data assets are stored, including enforcing access controls, encryption, and backup measures
Privacy Officer
Oversees privacy-related data, such as PII, SPI, and PHI ensuring compliance with legal and regulatory frameworks
Data Ownership Responsibility
The IT Department (CIO or IT personnel) should NOT be the data owner; data owners should be individuals from the business side who understand the data’s content and can make informed decisions about classification
Selection of Data Owners
Should be designated within their respective departments based on their knowledge of the data and its significance within the organization
- example: CFO controls financial data
Data at Rest
Data stored in databases, file systems, or storage systems, not actively moving
Encryption Methods
- Full Disk Encryption (FDE) = Encrypts the entire hard drive
- ** Partition Encryption** = Encrypts specific partitions, leaving others unencrypted
- Volume Encryption = Encrypts selected files or directories
- Database Encryption = Encrypts data stored in a database at column, row, or table levels
- Record Encryption = Encrypts specific fields within a database record
Data in Transit
Data actively moving from one location to another, vulnerable to interception
Can be protected with transport encryption methods:
- SSL
- VPN
- IPSec
Secure Sockets Layer (SSL)
Secure communication over networks, widely used in web browsing and email
Virtual Private Network (VPN)
Creates secure connections over less secure networks like the internet
Internet Protocol Security (IPSec)
Secures IP communications by authenticating and encrypting IP packets
Data in Use
Data actively being created, retrieved, updated, or deleted
Protection measures:
- Encryption at the application level = encrypts data during procession
- Access controls = Restricts access to data during processing
- Secure Enclaves = Isolated environments for processing sensitive data
- Mechanisms like INTRL Software Guard; encrypts data in memory to prevent unauthorized access
Regulated data
Controlled by laws, regulations, or industry standards
Compliance requirements:
- General Data Protection Regulation (GDPR)
- Health Insurance Portability and Accountability Act (HIPPA)
Personal Identification Information (PII)
Information used to identify and individual
- names
- social security number
- addresses
