Módulo 13 - Data Protection and Compliance Flashcards
(93 cards)
1
Q
List:
Impacts of non-compliance with data protection laws
A
- Legal sanctions
- Financial penalties
- Legal liabilities
- Reputational damage
- Loss of customer trust
- Increased regulatory scrutiny
2
Q
List:
Consequences of a data or privacy breach
A
- Reputation damage
- Identity theft
- Fines
- Intellectual property (IP) theft
- Escalation risks
3
Q
List:
Notifications required in data breaches
A
- Regulator
- Law enforcement
- Affected individuals
- Third-party companies
- Public (media or social channels)
4
Q
List:
Impacts of contractual non-compliance
A
- Breach of contract
- Termination of contracts
- Indemnification and liability
- Non-compliance penalties
5
Q
List:
Forms of non-compliance with software licensing
A
- Exceeding permitted installations
- Unauthorized sharing
- Unauthorized usage
- Modifying code
- Distributing software without authorization
6
Q
Define:
Security compliance
A
Adherence to standards, regulations, and practices to protect sensitive data.
7
Q
Define:
Sanctions
A
Penalties for non-compliance with laws or rules.
8
Q
Define:
Data breach
A
Unauthorized reading, modification, or deletion of data.
9
Q
Define: Privacy breach
A
Loss or disclosure of personal and sensitive data.
10
Q
Define:
Escalation in data breaches
A
Raising the issue to senior decision-makers for legal and regulatory assessment.
11
Q
Define:
Indemnification in contracts
A
Shifting liability for damages or legal costs to another party.
12
Q
Define:
Non-compliance penalties
A
Fines or damages stipulated in contracts for failing cybersecurity measures.
13
Q
Define:
License remediation
A
Correcting non-compliance with software licenses.
14
Q
List:
Types of regulated data
A
- Financial information
- Healthcare records
- Social security numbers
- Credit card details
- Personally identifiable information (PII)
15
Q
List:
Types of human-readable data
A
- Text
- Images
- Multimedia content
- Documents
- Reports
- Emails
- Presentations
16
Q
List:
Types of non-human-readable data
A
- Binary code
- Encrypted data
- Machine-readable formats
- Complex structured data
- Encoded information
17
Q
List:
Security measures for non-human-readable data
A
- Encryption
- Access controls
- Intrusion detection and prevention
- Secure data exchange
- Code/application security
18
Q
List:
Data classification levels based on confidentiality
A
- Public (unclassified)
- Confidential (secret)
- Critical (top secret)
19
Q
List:
Data classification levels for government and military
A
- Unclassified
- Sensitive
- Confidential
- Secret
- Top Secret
- Top Secret Compartmentalized
20
Q
List:
Examples of private/personal data
A
- Names
- Addresses
- Social security numbers
- Financial information
- Login credentials
- Biometric data
- Health records
21
Q
List:
Categories of proprietary data
A
- Intellectual property (IP)
- Trade secrets
- Product information
- Service information
22
Q
Define:
Data types
A
Categorization of data based on characteristics and use.
23
Q
Define:
Regulated data
A
Data subject to legal and regulatory requirements for handling and protection.
24
Q
Define:
Trade secrets
A
Confidential information giving a business a competitive advantage.
25
Define:
Human-readable data
Data easily understood by humans, such as text and images.
26
Define:
Non-human-readable data
Data requiring specialized software to interpret, such as binary or encrypted formats.
27
Define:
Data classification schema
A system to label data based on confidentiality and type.
28
Define:
Proprietary information
Nonpublic data owned by a company, like intellectual property.
29
Define:
Restricted data
Highly confidential data with stringent access controls.
30
Acronym:
PCI DSS
Payment Card Industry Data Security Standard
31
Acronym:
PII
Personally Identifiable Information
32
List:
Examples of privacy data
1. Names
2. Addresses
3. Contact information
4. Social security numbers
5. Medical records
6. Financial transactions
33
List:
Examples of confidential data
1. Trade secrets
2. Intellectual property
3. Financial statements
4. Proprietary algorithms
5. Source code
34
List:
Rights of data subjects under GDPR
1. Right to access
2. Right to rectification
3. Right to erasure
4. Right to restrict processing
5. Right to data portability
6. Right to object
7. Right to withdraw consent
35
List:
Impacts of privacy laws on data inventories and retention
1. Maintaining detailed records
2. Identifying legal grounds for processing
3. Ensuring data minimization
4. Defining retention periods
5. Responding to data subject requests
6. Implementing robust security measures
36
List:
Responsibilities of data processors under GDPR
1. Process data only as instructed by the controller
2. Implement appropriate security measures
3. Maintain confidentiality and integrity of data
4. Keep records of processing activities
5. Cooperate with data controllers
37
List:
Responsibilities of data controllers under GDPR
1. Define purposes and means of processing
2. Obtain consent from data subjects
3. Provide privacy notices
4. Implement data protection policies
5. Handle data subject requests
38
Define:
Privacy data
Personal information linked to an individual's identity and privacy rights.
39
Define:
Confidential data
Information requiring protection due to business or proprietary sensitivity.
40
Define:
Data controller
Entity deciding why and how personal data is processed.
41
Define:
Data processor
Entity processing personal data on behalf of the controller.
42
Define:
Data subject
Individual whose personal data is being processed.
43
Define:
Right to be forgotten
Data subject's right to request deletion of personal data under certain conditions.
44
Define:
Data minimization
Collecting only necessary data for specific and legitimate purposes.
45
Define:
Data inventory
Record detailing personal data types, processing purposes, and recipients.
46
List:
Steps in the decommissioning process
1. Data sanitization
2. Reset to factory settings
3. Physical destruction of components (if necessary)
4. Documentation and inventory updates
47
List:
Methods for secure data sanitization
1. Data wiping
2. Degaussing
3. Encryption
48
List:
Methods for secure data destruction
1. Shredding
2. Crushing
3. Incinerating
4. Overwriting
49
List:
Circumstances requiring data destruction
1. End of data retention period
2. Compliance with regulations (e.g., GDPR, HIPAA)
3. Decommissioning storage devices
4. Reducing outdated data
50
List:
Key concepts in asset disposal
1. Sanitization
2. Destruction
3. Certification
51
List:
Steps to decommission a multifunction network printer
1. Sanitize stored print jobs and documents
2. Wipe network credentials and configuration data
3. Perform a full factory reset
4. Securely dispose of or destroy physical components
5. Update asset inventory
52
List:
Overwriting steps for HDD sanitization
1. Pass of all zeros
2. Pass of all ones
3. Pass in a pseudorandom pattern
53
Define:
Decommissioning
Process of securely retiring devices by erasing data and resetting configurations.
54
Define: Data sanitization
Removing sensitive information to ensure it cannot be recovered.
55
Define:
Data destruction
Physically or electronically eliminating data to make it irrecoverable.
56
Define:
Certification (in asset disposal)
Documentation verifying secure data sanitization or destruction.
57
Define:
Overwriting
Sanitization method replacing data with patterns of zeros, ones, and random data.
58
Define:
Zero filling
Overwriting method setting all bits on a drive to zero.
59
Acronym:
GDPR
General Data Protection Regulation
60
Acronym:
HIPAA
Health Insurance Portability and Accountability Act
61
List:
Phases of personnel management in HR
1. Recruitment
2. Operation
3. Termination/Separation
62
List:
Key components of onboarding
1. Secure transmission of credentials
2. Asset allocation
3. Training and policies
63
List:
Processes involved in offboarding
1. Account management
2. Retrieval of company assets
3. Wiping personal assets of corporate data
4. Changing shared credentials
64
List:
Topics covered in security awareness training
1. Security policies and penalties for noncompliance
2. Incident identification and reporting
3. Data handling and confidentiality
4. Password and account management
5. Social engineering and malware threats
6. Secure software usage
65
List:
Security training methods
1. Workshops
2. One-on-one mentoring
3. Computer-based training (CBT)
4. Videos and blogs
5. Simulations
6. Gamification
66
List:
Security awareness training lifecycle stages
1. Assessing needs and risks
2. Planning and designing activities
3. Developing materials
4. Delivering training
5. Evaluation and feedback
6. Reinforcement
7. Monitoring and adaptation
67
List:
Examples of risky behaviors
1. Clicking on suspicious links
2. Visiting untrusted websites
3. Downloading unauthorized software
4. Sharing credentials
5. Ignoring software updates
68
List:
Techniques to detect anomalous behavior
1. Network intrusion detection
2. User behavior analytics
3. System log analysis
4. Fraud detection
69
Define:
Acceptable Use Policy (AUP)
Guidelines for proper use of organizational equipment and resources.
70
Define:
Onboarding
Welcoming and equipping new employees or contractors with tools and training.
71
Define:
Offboarding
Process ensuring employees or contractors leave without retaining access or assets.
72
Define:
Clean desk policy
Work areas must be free of documents to protect sensitive information.
73
Define:
Anomalous behavior
Actions or patterns deviating from normal expectations.
74
Define:
Gamification
Using game-like elements in training to improve engagement and learning.
75
Define:
Phishing simulation
Simulated attacks to train employees to recognize and respond to phishing.
76
Define:
Shadow IT
Unauthorized use of personal software or services in the workplace.
77
List:
States of data for protection measures
1. Data at rest
2. Data in transit (or motion)
3. Data in use
78
List:
Components of Data Loss Prevention (DLP)
1. Policy server
2. Endpoint agents
3. Network agents
79
List:
Typical remediation mechanisms in DLP
1. Alert only
2. Block
3. Quarantine
4. Tombstone
80
List:
Approaches to maintain data sovereignty compliance
1. Data localization using local datacenters
2. Contractual agreements with vendors
3. Location-specific cloud storage facilities
81
List:
Geographic access requirement impacts
1. Data storage locations and sovereignty
2. Constraint-based access controls
3. Data replication and dispersion
4. Jurisdiction-specific legal requirements for forensics
82
List:
Benefits of a data retention policy
1. Reduced discovery costs during litigation
2. Reduced exposure to potential litigation risks
3. Lower hardware/software requirements for old data
4. Protection from evidence destruction accusations
83
List:
Data retention best practices
1. Delete emails after 90 days
2. Retain tax-related information for seven years
3. Keep employee records for four years post-employment
4. Retain research/patents for 25 years
5. Keep vendor contracts for five years post-expiration
6. Delete employee files after one year
84
Define:
Data protection
Measures to secure data from unauthorized access, loss, or misuse.
85
Define:
Compliance
Adherence to legal, regulatory, and industry requirements.
86
Define:
Data at rest
Data stored on persistent media, like databases or files.
87
Define:
Data in transit
Data transmitted over a network.
88
Define:
Data in use
Data present in volatile memory or being processed.
89
Define:
Data sovereignty
Jurisdictional control over data storage and processing.
90
Define: DLP policy server
Configures classification and privacy rules, logs incidents, and compiles reports.
91
Define:
Tombstone (DLP)
Replaces a quarantined file with a notice about the policy violation.
92
Define:
Data retention policy
Defines how long data is retained and procedures for archiving or destruction.
93
Define:
Due diligence in data protection
Assessing and verifying the adequacy of security and compliance practices.
