Data Protection

Data Protection

Process of safeguarding info from corruption, compromise, or loss

Data Classifications

Based on the value of the organization and the sensitivity of the information, determined by the data owner.

Sensitive Data

any information that, if accessed by unauthorized means, can result in the loss of security or competitive advantage for a company

Why must you be careful about overclassifying?

You need to protect everything at a high level, causing usage of more resources and expenses

Type of Classification

Commercial Business, Government

Commercial Business Classification Levels

Public, Sensitive, Private, Confidential, Critical

Government Classification Levels

Unclassified, Sensitive but Unclassified, Confidential, Secret, Top Secret

Public

Accessible data publicly

Sensitive

Minimal impart if released like financial data

Private

Internal personal or salary infomation, relates to individual entity

Confidential (commercial)

Serious effect to business if released, holds trade secrets, source code, intellectual property

Critical

Extremely valuable and restricted information

Unclassified

Generally releasable to the public

Sensitive but Unclassified

Medical records, personnel files, won’t hurt national security but will impact people in organization if released

Confidential (government)

Contains information that can seriously effect the government

Secret

Serious damage to government and national security, military plans, defensive postures

Top Secret

Data that would damage national security if disclosed, highly sensitive information

Life Cycle of Data

Collect, Retain, Dispose. Must be well defined in policies and follow laws for data retention

Data Ownership

Process of identifying the person responsible for the CIA and privacy of information assets

Data Owner

Maintains the CIA of the information asset, senior executive role ensures that the data is protected with appropiate roles

Data Controller

Decides the purposes and methods of data storage, collection, and usage, purposes and methods, as well as ensuring the legality of these processes. Held ultimately responsible for any breach

Data Processor

Hired by data controller to assist with tasks like collecting, storing, or analyzing the data

Data Steward

Focused on the quality and metadata, assuring it is appropriately labeled and classified, works under data owner

Data Custodian

Handles management of system where the data assets are stored, including enforcing access controls, encryption, backup measures

Privacy Officer

Oversees privacy-related data like PII, SPI, or protected health information (PHI), ensuring compliance with legal and regulatory frameworks

Who should the data owner be?

Someone on the business side who understands the data’s content and can make informed decisions about classification

Data at Rest

Data stored in databases, file systems, or other storage systems, not actively moving, prime target for attackers and must be protected with encryption

Full Disk Encryption (FDE)

Encrypts entire hard drive

Types of Encryption for data at rest

Full Disk, Partition, File, Volume, Database, Record

Partition Encryptions

Only encrypts specific partitions of hard drive, leaves other unencrypted

Volume Encryption

Encrypts selected files or directories

Record Encryption

Encrypts specific fields within a database record

Data in Transit (Data in Motion)

Actively moving from one location to another, vulnerable to interception

How to protect data in transit?

SSL and TLS, VPN, IPsec

Virtual Private Network (VPN)

Creates secure connections over less secure networks like internet

SSL (Secure Sockets Layer) and TLS (Transport Layer Security)

Secure communication over networks, widely used in web browsing and email

IPsec (Internet Protocol Security)

Secures IP communications by authenticating and encrypting the packets in a data stream

Data in Use

Data in the process of being created, retrieved, updated, or deleted.

How to protect data in use?

Encryption at the Application Level, Access Controls, Secure Enclaves, Mechanisms like INTEL Software Guard

Encryption at Application Level

Encrypts data during processing

Access controls

restricts access to data during processing

Secure enclaves

isolated environments for processing sensitive data

INTEL Software Guard

Encrypts data in memory to prevent unauthorized access

Regulated Data

Controlled by laws, regulations, and industry standards like GDPR (General Data Protection Regulation) or HIPAA (Health Insurance Portability and Accountability Act

Personal Privat Information (PII)

info that can identify an individual like a social security number, name, address

Protected Health Information (PHI)

Information about health status, healthcare provision, or payment linked to individual. Protected by HIPPA

Trade Secrets

Confidential business information giving a competitive edge and is legally protected

Intellectual Property (IP)

Creations of the mind like inventions, protected by patents and copyrights, trademarks

Legal Information

Data related to legal proceedings, contracts, regulatory compliance

Financial Information

Related to financial transactions and targeted by criminals for fraud and identity theft, subject to PCI DSS (Payment Card Industry Data Security Standard)

Human-Readable Data

Understandable directly by humans like documents and spread sheets

Non-Human readable data

Requires machine or software to interpret (binary code, machine language, etc). Contains sensitive information and needs protection

Data Sovereignty

Digital information is subject to laws of the country where it’s located, gained importance with cloud computing’s global data storage

GDPR (General Data Protection Regulation)

Protects any EU citizen’s data withing EU and EEA borders, compliance regardless of data location with significant fines if non-compliance

Data Sovereignty Laws

Countries like Russia and Chine. Require data storage and processing within national borders

Geofencing (Geographic Restrictions)

Virtual boundaries to restrict date access based on location, compliance with data sovereignty laws and prevent unauthorized access from high-risk locations

Encryptions

Makes plaintexts into ciphertext using an algorithm with a decryption key. Crucial for data at rest and in transit

Hashing

Converts data into a fixed size of numerical or alphanumeric characters, known as a hash value. This is irreversible and used for password storage

Masking

Replaces some or all of the data with placeholders like an X

Tokenization

replaces sensitive data with non-sensitive substitutes like tokens

Obfuscation

Making data unclear or unintelligible to make it hard for unauthorized users to understand it

Segmentation

Dividing a network into separate segments, each with its own security controls

Permission Restrictions

Defining who has access to specific data and what they can do with it

Data Loss Prevention (DLP)

Aims to monitor data in use, in transit, or at rest to detect and prevent data theft

Types of DLP systems

Endpoint DLP System, Network DLP System, Storage DLP System, Cloud-Based DLP System

Endpoint DLP system

Installed as software on workstations or laptops, Monitors data on individual computers and can prevent or alert file transfers based on predefined rules

Network DLP System

Software or hardware placed at the network perimeter, Focuses on monitoring data entering and leaving the network, detects unauthorized data leaving network

Storage DLP System

Installed on a server in the data center. It inspects data at rest, especially encrypted or watermarked data. Monitors data access patterns and flags policy violations

Cloud-Based DLP System

Software-as-a-service solution and protects data in cloud services