Section 12: Data Protection

Regulated Data

includes data that is subject to regulatory requirements, such as personal data protected under laws like GDPR, health info covered by HIPAA, or financial under PCI-DSS

Ways to Protect Intellectual Property

• Copyright

• Trademark

• Patents

• Trade Secrets

• NDAs

Copyright Laws

grants protections against unauthorized duplications of an original creative work. It protects creative expression of ideas or resources rather than the idea or resources.

Copyright Protection

70 years after the death of the last remaining author of work unless its ‘work for hire’

Work for Hire

And anonymous works are protected 95 years from the first date of publication or 120 years from the date of creation, whichever is shorter.

Trademarks

protects words, names, symbols, sounds, shapes, colors, musical tones used to identify products or to distinguish from others. Its primary purpose is to avoid confusion in the marketplace.

Trademarks length

granted for an initial period of 10 years and can be renewed an unlimited number of times for another 10 years.

Patents

protects the rights of investors and their inventions; Owner has exclusive control of the invention for 20 years after which the invention enters public domain.

Trade Secrets

are nay form of info, device method, or formula that if disclosed, will cause significant damage to an organization.

NDAs

are used to prohibit the sharing of trade secrets.

Data Types

• Legal Info

• Financial Info

• Readable and Non Readable Data

Legal Info

encompasses info pertaining to legal manners. Breaches can compromise attorney-client privilege.

Financial Info

includes details about transactions, financial records, credit info.

Readable Data

easily interpretable by humans such as text docs, images and printed info.

Non-Readable Data

requires specific tools or software to interpret, like encrypt data, machine code or log files.

Data Owner determines the classification of the data. They define criticality, sensitivity, will estimate value and replacement cost, and ensure proper declassification and deconstruction.

True

Goals of Data Classification

CIA, Sensitivity, and Criticality (Private industry emphasize CIA)

Data Classification is an umbrella term, that affects all controls of the data.

True

Geolocation

relates to the physical or geographical location of data

Data Sovereignty

the legal concept that data is subject to the laws and governance structures of the country in which it is collected and stored

Organizations must ensure that their data handling and storage practices comply with laws of the country where its collected, stored, and processed.

True

Geographic Restrictions

this involves restricting the physical location where data can be stored and accessed

Hashing produces integrity of information

True