7: Data protection

Data Protection

The process of safeguarding important information from corruption, compromise, or loss.

Commercial Data Classifications (Lowest to Highest)

Public, Sensitive, Private, Confidential, and Critical.

Government/Military Data Classifications (Lowest to Highest)

Unclassified, Sensitive but Unclassified, Confidential, Secret, and Top Secret.

Data Owner

A senior executive with ultimate responsibility for the CIA triad and labeling of data assets.

Data Controller

The entity accountable for defining the purposes, methods, and legal compliance of data processing.

Data Processor

An individual or third party hired by the controller to collect, store, or analyze data.

Data Steward

A role focused on data quality, accuracy, metadata, and maintaining proper labeling.

Data Custodian

A technical role (e.g., sysadmin) responsible for managing systems, backups, and access controls.

Data Privacy Officer (DPO)

Oversees privacy-related data compliance (PII/PHI) and ensures adherence to legal frameworks.

Data At Rest

Static data stored in databases, file systems, or storage media.

Data In Transit

Data actively moving across a network or between endpoints.

Data In Use

Data actively being processed in system memory (RAM) or CPU registers.

Data Sovereignty

The principle that digital data is subject to the laws of the country where it is collected or processed.

Data Hashing

A one-way cryptographic transformation that converts data into a fixed-length string to ensure integrity.

Data Masking

Replacing sensitive data fields with placeholders (e.g., X's) to conceal actual values.

Data Tokenization

Replacing sensitive information with non-sensitive reference tokens, mapped securely in a separate database.

Endpoint DLP

Software on end-user devices that monitors and prevents unauthorized file transfers or data leaks.

Network DLP

A hardware or software boundary solution that monitors network traffic exiting the perimeter.

Storage DLP

Software installed on central storage servers to inspect unencrypted or improperly accessed data at rest.

Cloud-based DLP

SaaS solutions integrated into cloud storage and productivity suites to monitor and enforce sharing policies.