3.3 — Protecting Data

Regulated Data

Data subject to external requirements that may specify how it must be stored, protected, or retained.

Trade Secret

Nonpublic business information or processes that provide value to an organization and should remain confidential.

Intellectual Property

Creations or information legally protected through mechanisms such as copyright or trademark and which may sometimes be publicly visible.

Legal Information

Data related to legal matters that may include both public records and private information such as PII.

Financial Information

Sensitive information involving organizational or individual finances and financial transactions.

Human-Readable Data

Data represented in a format a person can directly understand.

Non-Human-Readable Data

Data represented primarily for processing or interpretation by machines.

Barcode Example

A barcode may contain machine-readable bars along with human-readable numbers.

Data Sensitivity

Level of protection required for information based on its importance, privacy, or potential impact if disclosed.

Proprietary Data

Data owned by or unique to an organization.

PII

Personally Identifiable Information. Information that can identify an individual, such as name, date of birth, address, mother's maiden name, or biometrics.

PHI

Protected Health Information. Information involving an individual's health status, health records, or healthcare payment information.

PII vs PHI

PII identifies an individual, while PHI specifically involves identifiable health-related information.

Sensitive Classification

Data requiring protection because unauthorized disclosure could cause harm or violate organizational requirements.

Confidential Classification

Data intended to remain private and accessible only to authorized individuals.

Public or Unclassified Data

Data that does not require the same access restrictions as sensitive or classified information.

Private Classified or Restricted Data

Data with stronger access restrictions because disclosure could cause significant harm or violate requirements.

Critical Data

Data that is especially important to operations and must remain available.

Data at Rest

Data stored on media such as drives, databases, or other storage systems.

Protecting Data at Rest

Use controls such as encryption and permissions to protect stored information.

Data in Transit

Data actively moving across a network. Also called data in motion.

Protecting Data in Transit

Use controls such as firewalls, IPS, TLS, VPNs, and IPsec to protect moving data.

Data in Use

Data actively being processed by a CPU or stored temporarily in memory.

Data in Use Risk

Data in memory may need to be decrypted for processing, making it an attractive target for attackers.

Three Data States

Data at rest is stored, data in transit is moving, and data in use is actively being processed.

Target Breach Data-in-Use Example

The source uses the 2013 Target breach as an example where point-of-sale malware captured payment card information from memory.

Data State Protection Lesson

Protecting data at rest and in transit is not sufficient if attackers can access sensitive information while it is being processed.

Data Sovereignty

Data stored in a country is subject to that country's laws and regulations.

GDPR

Regulation mentioned in the source in connection with geographic and data sovereignty considerations.

Geographic Restrictions

Security policies that make decisions based on the physical location of data or users.

IP-Based Location

An IP subnet can sometimes identify a user's location, especially on known internal private networks, but is less reliable for mobile and wireless devices.

Geolocation

Determining the physical location of a device or user using information such as GPS, wireless networks, or network information.

GPS Geolocation

Uses Global Positioning System information to determine physical location.

802.11 Geolocation

Can compare visible wireless SSIDs with databases of known wireless networks to estimate a mobile device's location.

Geofencing

Making access-control decisions based on geographic location.

Geolocation vs Geofencing

Geolocation determines where a user or device is, while geofencing uses that location to allow or deny access.

Geofencing Example

An organization may allow access to sensitive data only while a user is physically inside corporate facilities.

Protecting Data Everywhere

Data may exist on storage devices, mobile systems, networks, CPU, or memory and should be protected regardless of its current location.

Encryption

Transforms readable plaintext into unreadable ciphertext using cryptographic methods.

Plaintext

Original clear and readable data before encryption.

Ciphertext

Data after encryption that should be unreadable without the proper decryption process and key.

Decryption

Transforms ciphertext back into readable plaintext using the appropriate key and process.

Confusion

Cryptographic characteristic described in the source where encrypted output appears dramatically different from the original plaintext.

PGP

Encryption technology used in the source example to demonstrate transforming the message Hello, world into ciphertext.

Hashing

Creates a fixed representation of data called a hash, message digest, or fingerprint and is not intended to recreate the original plaintext.

Message Digest

Another term for a hash value representing the contents of data.

Digital Fingerprint

Another way to describe a hash because it provides a compact representation of data.

Hashing for Passwords

Passwords can be represented by hashes so the original plaintext password does not need to be directly stored.

Hashing for File Integrity

A known file hash can be compared with a downloaded file's hash to determine whether the file has changed.

Hashing and Digital Signatures

Hashing can be combined with public key cryptography to support digital signatures, sender authentication, and integrity verification.

Collision

Occurs when two different inputs generate the same hash value.

Hash Collision Risk

Algorithms that are weak and produce collisions too easily may need to be retired.

SHA-256

Hashing algorithm that produces a 256-bit output represented as 64 hexadecimal characters.

Avalanche-Like Hash Behavior

A very small change to the input, such as changing punctuation, produces a dramatically different hash output in the source example.

Encryption vs Hashing

Encryption produces ciphertext that can be decrypted with the proper key, while hashing creates a one-way representation not intended to recreate the original data.

Obfuscation

Transforms understandable information into a form that is difficult for humans to recognize while preserving its function.

Code Obfuscation

Developers may make source code difficult to understand while allowing it to continue functioning normally.

Malicious Obfuscation

Attackers may obfuscate malicious scripts or code to make them harder for people and security tools to recognize.

Obfuscation Example

The source converts simple PHP code that prints Hello, world into difficult-to-read PHP that still produces the same output.

Data Masking

Hides portions of sensitive information so unnecessary details are not exposed.

Data Masking Example

A payment receipt may replace most digits of a credit card number with asterisks while displaying only the final four digits.

Masking Methods

Data masking may use techniques such as shuffling, encryption, or replacing characters with asterisks.

Tokenization

Replaces sensitive information with a different token that represents the original information without exposing it.

Tokenization Examples

Social Security numbers and payment card information can be replaced with tokens.

Mobile Payment Tokenization

A mobile device can use a temporary payment token instead of transmitting the original credit card number during a transaction.

Token Replay Protection

A temporary or one-time payment token cannot simply be captured and successfully reused after it has already been used.

Tokenization Relationship

The token and original sensitive value are different values and the original value cannot be derived directly from the token.

Tokenization and Encryption

The source notes that encryption or hashing is not required to create the relationship between the original value and its token.

Tokenization Registration Process

Card details are sent to a remote token service, the service provides tokens to the mobile device, and those tokens can later represent the card.

Tokenized Payment Process

The device sends a token through NFC, the store sends it for validation, and the token service validates the token.

Encryption vs Hashing vs Masking vs Tokenization

Encryption makes data unreadable and reversible with a key, hashing creates a one-way fingerprint, masking hides part of the original value, and tokenization substitutes a different value.

Obfuscation vs Encryption

Obfuscation makes information difficult for humans to understand while retaining its function, while encryption transforms plaintext into ciphertext that requires proper decryption.

Data Segmentation

Separates information into smaller pieces or different databases or locations rather than storing everything together.

Data Segmentation Benefit

An attacker may need to compromise multiple systems to obtain all information, and different datasets can receive different security levels.

Data Segmentation Example

A database containing only names may use different protections from databases containing healthcare or financial information.

Permission Restrictions

Limit what authenticated users can access or perform based on account rights, groups, and file permissions.

Authentication Before Permissions

Begin with secure authentication and appropriate password policies or additional factors before applying authorization and permission restrictions.

Authentication vs Permissions

Authentication verifies the user's identity, while permissions determine which data or resources that authenticated user can access.