Lesson 12 - Compare and Contrast Concepts and Strategies to Protect Data

Categories of Data

Regulated, Personally Identifable, Intellectual Property, Contractually Protected, Organizationally Classified

Regulated

data protected by law, regulations, or industry standards

Personally Identifiable

data that can be used to identify a specific individual

Intellectual Property (IP)

intangible creations

Contractually Protected

data that is specified in a contract or agreement

Organizationally Classified

data that meets classification criteria

Jurisdiction

in info sec, refers to the location of data and systems, the type of data, the residences of data owners, and the residence of data subjects

GRC (Governance, Risk, and Compliance)

system used by organizations to structure governance, risk management, and regulatory compliance. Used to unify an organizations approach to risk management and compliance.

GLBA (Gramm-Leach-Billey Act)

related to security and privacy of consumer financial records

HIPPAA (Health Insurance Portability and Accountability Act)

regulates the security and privacy of medical records

FERPA (Family Educational Rights and Privacy Act)

regulated the security and privacy of student educational records

COPPA (Children's Online Privacy Protection Act)

regulates security and privacy related to only collection of children under 13

GDPR (General Data Protection Regulation)

PII regulation to protect people in the EU and EEA from unlawful data collection and processing

CCPA (California Consumer Privacy Act)

PII regulation to protect California residents from abuse of PII

Patent

gives its owner legal rights to exclude others from making/using/selling and invention w/i a certain period of time in exchange for publishing a public disclosure of the invention

Trademark

protects recognizable shapes, colors, and sounds used to represent a brand/entity

Copyright

allow the creation of certain original works to benefit from being credited and compensated for their work

Trade Secret

proprietary business and technical information that is confidential and critical to a business

Freeware

copyrighted software that is available for free but whose developer still retains all rights to the program and controls distribution

Shareware

copyrighted software that is available for free where users are encouraged to share to promote larger distribution

Open Source

copyright holder grants users the right to study, change and distribute the software to anyone for any reason

Commercial off-the-shelf (COTS)

copyrighted. software that a company develops to sell or license. the company retains all rights to the program and controls distribution

PCI DSS

Payment Card Industry Data Security Standard.

Example of a Contractual Obligation for any entity that deals with payment cardholder data

Classification

The process of organizing assets by criticality and sensitivity. Asset classficiations inform risk management decisions and protection strategies.

Criticality

measure of the impact of asset loss

Sensitivity

measure of the impact of asset exposure

Private Sector classifications are discretionary (T or F)

True. There isn't really a set standard for them and its up to each organization what they want to do

Unclassified

information does not need to be protected and can be released to the public

Controlled Unclassified Information

information needs to be protected and requires stricts controls over its distribution

Confidential

disclosure causes damage to national security

Secret

disclosure causes serious damage to national security

Top Secret

Disclosure causes exceptionally grave national damage.

Labeling

the vehicle for communicating assigned asset classifications to custodians, users, and applications

Handling Standards

inform custodians and users how to protect the information they use and the systems they interact with. Determined by classification level

Data Management

the planning and execution of policies and practices that protect data confidentiality, integrity, and availability. Based on data classification and state (at rest, in use, in transit)

Role of Directors and Executive Management

responsible for governance and oversights. Ultimately responsible for the actions of the organization

Role of Data Owners

responsible for decisions related to classification, access control, and protection

Role of Data Custodians

responsbile for adivising, implementing, managing, and monitoring data protection controls.

Role of Data Users

responsible for interacting with systems in accordance with organizational policy and handling standards

Data Masking

technique used to protect sensitive data by replacing it with fictional or de-identified data (e.g. replacing data with symbols, shuffiling data, etc)

Tokenization

technique to secure data by replacing the original data with an unrelated value of the same length and format. Tokenized data is irreversible and can only be swapped back to the original data by the tokenization system.

Data Obfuscation

making a data set difficult to understand or find by unauthorized users. Makes use of data hiding and data abstraction

Data Hiding

Programming technique of hiding internal object details which allows for restricted access

Data Abstraction

programming process of creating a data type that hides the deails of the data representation, separating interface from implementation