technical data and privacy controls

icacls

a command line tool for showing and modifying file permissions

permission types

read(r ) - the ability to access and view the contents of a file or list the contents of a directory

write(w) - the ability to save changes to a file, or create, rename, and delete files in a directory(deleting requires execute)

execute(x) - the ability to run a script, program, or other software file, or the ability to access a directory, execute a file from that directory, or perform a task on that directory

group premissions

these permissions determine what members of the file’s group who are not its owner can do with the file

world/other permissions

these permissions determine what users who are not the file’s owner or members of its group can do with the file

chmod

a linux command that is used to modify permissions for files

chown

a linux command that is used to modfy the owner of a file

data at rest

protected by whole idsk encryption, database encryption, file encryption, or folder encryption

data in transit

protected by transport encryption protocols like IPSec, TLS, WPA2

data in use

protected by secure processing mechanisms

data loss preventation(DLP)

a software solution that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks

includes policy server, endpoint agents, network agents

classification(DLP discovery and classification)

a rule based on a confidentiality classification tag or label attached to the data

dictionary(DLP discovery and classification)

a set of patterns that should be matched

policy template(DLP discovery and classification)

a template that contains dictionaries optimized for data points in a regulatory or legislative schema

exact data match(EDM)

a pattern matching technique that uses a structured database of string values to detect matches. for example, a company might have a list of actual social security number of its customers. but, since it is not appropriate to load these numbers into a DLP filter, they could use EDM to match fingerprints of the numbers instead based on their format or sequence

document matching

matching based on an entire or partial document based on hashes

statistical/lexicon

a further refinement of partial document matching which uses machine learning to analyze a range of data sources

deidentification

methods and technologies that remove identifying information from data before it is distributed

• often implemented as part of database design

data masking

a deidentification method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data

tokenization

a deidentification method where a unique token is substituted for real data

aggregation/banding

a deidentification technique where data is generalized to protect the individuals involved

reidentification

an attack that combines a deidentified dataset with other data sources to discover how secure the deidentification method used is

digital rights management(DRM)

copyright protection technologies for digital media which attempts to mitigate the risk of unauthorized copies being distributed

• can be implemented using hardware or software approaches

watermarking

method and technology that applies a unique-tamper signature or message to a copy of a document

forensic watermark

a digital watermark that can defeat attempts at removal by cropping pages or images in the file