Data Protection: Process of safeguarding important information from corruption, compromise, or loss.

Data Classification

Category based on organizations value and sensitivity of the information if it were to be disclosed.

Sensitive Data: Information that can result in loss of security or market advantage if accessed by an unauthorized person.

We cannot protect everything equally, so we have different categories. Overclassifying data and protecting all data at a high level results in wasting time, money, and resources.

Two Classification Schemes:

1. Commercial Business:
   • Public: No impact on company if released and often posted in an open-source environment.
   • Sensitive: Minimal impact if released (e.g., financial data).
   • Private: Data that should only be used within the organization (e.g., salary information, SSNs, etc.).
   • Confidential: Trade secrets, data, and source code that affect the business if disclosed.
   • Critical: Contains valuable information.
2. Government:
   • Unclassified: Can be released to public or under FOIA.
   • Sensitive but Unclassified: Would not impact national security but could impact those whose data was being used (e.g., the medical record of an individual soldier).
   • Confidential: Could seriously affect the government if unauthorized disclosures happen.
   • Secret: Could seriously damage national security if disclosed.
   • Top Secret: Would damage national security if disclosed.

Data Lifecycle

1. Collect
2. Retain
3. Dispose

Data is not stored forever, your organization needs to know:

• How is it stored?
• Where is it stored?
• How long will it be stored?
• How are you going to destroy it once you are done?

The lifecycle should be defined by organizational policy and is influenced by organizational needs and local/state/federal laws and regulations for data retention.

Data Ownership

Process of identifying the person responsible for the Confidentiality, Integrity, and Availability and privacy of the information assets.

1. Data Owner: Senior executive role responsible for maintaining the Confidentiality, Integrity, and Availability of the information asset. Handles labeling asset, protecting with appropriate controls.
2. Data Controller: Entity that holds responsibility for deciding the purposes and methods of data storage, collection, and usage, and for guaranteeing the legality of processes. Hold ultimate accountability for breaches of privacy (cannot delegate responsibility to another party).
3. Data Processor: Group/individual hired by data controller to help with tasks like collecting/storing/analyzing data. Works under controller.
4. Data Steward: Focused on quality of data and metadata. Works for data owner.
5. Data Custodian: Responsible for handling management of system on which data assets are stored (e.g., system administrators).
6. Data Privacy Officer: Responsible for oversight of any privacy-related data like PII, SPI, or PHI and complying with regulations. This person is really on the hook in the case of a data breach.

Who Owns the Data?:

• Ideally data custodian should be the business entity responsible for creating the information, with each owner being assigned to their own department.
• Commonly the ownership is just thrust-upon IT (which is a mistake).

Data States

Data at Rest

Stored in databases, file systems, or other storage systems. Not actively moving. Prime target for threat actors.

Defense:

1. Full Disk Encryption (FDE): Encrypts entire hard drive. Can be done by Operating System, third-party software, or disc device itself.
2. Partition Encryption: Encrypts specific partitions of a hard drive, leaving other partitions unencrypted.
3. File Encryption: Encrypts individual files.
4. Volume Encryption: Encrypts a set of selected files or directories.
5. Database Encryption: Encrypts data stored in a database. Can be done at the column, row, or table-level.
6. Record Encryption: Encrypts specific fields within a database record.

Data in Transit

Data actively moving form one location to another, such as across the Internet or through a private network. Vulnerable to interception.

Defense:

1. Secure Sockets Layer (SSL) & Transport Layer Security (TLS): Cryptographic protocols designed to provide secure communications over a computer network.
2. Virtual Private Networks (VPNs): Technology that create a secure connection of a less secure network (Internet).
3. Internet Protocol Security (IPSec): Protocol suite used to secure IP communications by authenticating and encrypting each IP packet in a data stream.

Data in Use

Data in the process of being created, retrieved, updated, or deleted. Defense is difficult because the data must be decrypted to be used.

Defense:

1. Application-level encryption
2. Access controls
3. Secure enclaves
4. Intel software guards (encrypted per-process memory)

Data Types

1. Regulated Data: Controlled by laws, regulations, or industry standards (e.g., GDPR, HIPAA).
   • PII: Information that can be used to identify an individual (Protected by GDPR).
   • PHI: Information about health status, provision of healthcare, or payment for healthcare that can be linked to a specific individual (Protected by HIPAA).
2. Trade Secrets: Confidential business information that provides company a competitive edge.
3. Intellectual Property (IP): Creations of the mind, such as inventions, literary and artistic works, designs, and symbols.
4. Legal Information: Data related to legal proceedings, contracts, or regularity compliance.
5. Financial Information: Related to an organizations financial transaction, such as sales records, invoice, tax documents, and bank statements (e.g., Payment Card Industry Data Security Standard).
6. Human and Non Human-Readable Data: Human-readable Data can be understood by humans without need for a machine/software. Non-Human-readable Data requires machine/software to interpret.

Data Sovereignty

Concept that digital information is subject the laws of the country in which it is located. Information is subject to the laws of the nation it is collected or processed.

Geographical Considerations:

• GDPR has stringent rules for data protection and grants individuals strong rights over their personal data.
• China and Russia require companies to store and process data within national borders.

You must know the physical location of data centers and the flow of data across borders. You must ensure information is not illegally transferred.

Securing Data

Mixing the following and protect data form internal and external threats.

• Geographic Restrictions: Involves setting up virtual boundaries to restrict data access based on geographic location.
• Encryption: Transforms readable data into unreadable data using an algorithm.
• Hashing: Process of converting data of arbitrary size into a fixed-size hash digest to ensure data integrity. Often used to store sensitive data like passwords.
• Masking: Replacing some or all data in a field to conceal original content.
• Tokenization: Replaces sensitive data with nonsensitive substitutes, known as tokens.
• Obfuscation: Involves making data unclear or unintelligible, making it difficult for unauthorized users to understand.
• Segmentation: Dividing network into separate segments each with its own security controls.
• Permission Restrictions: Defining who has access to specific data and what they can do with it.

Data Loss Prevention (DLP)

Set up to monitor data of a system in all states to detect any attempt to steal it. Can be software or hardware.

Endpoint DLP System

Software installed on a workstation or laptop that monitors the data that is in use on the computer. Like an IDS or IPS but for data. Can be detective or preventive.

Network DLP System

Software or hardware that is placed at perimeter of the network to detect data in transit.

Storage DLP

Software installed on a server in the data center and inspects the data while it is resting on the server. (e.g., if someone begins downloading too much data during off hours).

Cloud-based DLP System

Usually offered as SaaS and part of whatever cloud service you are already using for storage.