2.10 Security and Information Life Cycle

What are the steps in the information life cycle?

Collect, Store, Process, Share, and Achieve/Delete

What is personally identifiable information (PII)

One or more pieces of sensitive information that can be traced back to an individual

Examples of PII

Social security number, email address, credit card number, home address, web browser cookies containing sensitive session identifiers

What is protected health information (PHI)?

One or more pieces of sensitive medical information that can be traced back to an individual

Example of a PHI

Health insurance plan number, blood type, patient medical ailments

What are some privacy enhancing technologies?

Anonymization

The GDPR allows what kind of data collection to be used without user consent?

Anonymized

Anonymization Techniques

Pseudo-anonymization, data minimization, tokenization, data masking

What is pseudo anonymization?

Replaces PII with fake identifiers

What is data minimization?

Limit stored/retained sensitive data

What is tokenization?

Authorizes access instead of the original credentials

What is data masking?

Hide sensitive data from unauthorized users

Data Sovereignty

Location of data and laws that apply to it

Questions to ask when thinking about data sovereignty

Where did the data originate, where does the data reside, which laws/regulations apply to the data?