Understand the importance of data and asset classification. The data owner is responsible for maintaining data and asset classifications and ensuring that data and ensembles are properly tagged. In addition, data owners clarify protection requirements for different categories of data, such as encryption of sensitive data at rest and in transit. Data classification is usually defined in a security policy or data policy.
PII and PHI Definitions. Personally identifiable information (PII) is any information that can identify an individual. Protected health information (PHI) is any health-related information about a specific person. Many laws and regulations require the protection of PII and PHI.
Learn how to manage sensitive information. Sensitive information can be any type of classified information, and proper management helps prevent unauthorized disclosure resulting in a breach of confidentiality. Proper management includes the identification, processing, storage and destruction of sensitive information. Two areas that organizations often miss are: adequately protecting the backup media holding sensitive information and decontaminating the media or device at the end of its life cycle.
Describe the three states of data. The three states of data are static, in transit and in use. Data at rest is any data stored on a medium such as the system's hard drive or external media. Data in transit is any data transmitted over the network. Encryption methods protect data at rest and in transit. In-use data refers to data in memory or temporary storage buffers used by the application. Applications should flush memory buffers to remove data when the data is no longer needed.
Define DLP. Data loss prevention (DLP) systems detect and block attempts to cause data breaches by scanning unencrypted data for critical data patterns. Network-based DLP systems, including cloud-based DLP systems, scan files before they leave the network. Endpoint-based DLP systems prevent users from copying or printing certain files.
Compare data destruction methods. Erasing a file does not delete the file. Cleaning media means overwriting the media with characters or bits. The purge process repeats the purge process multiple times and deletes data so that the media can be reused. Degaussing can remove data from tape and magnetic hard drives, but degaussing does not affect optical CDs, DVDs, or sSDs. Destruction methods include incineration, crushing, decomposition and dissolution.
Describe data residue. Data remnant is data that should have been deleted but remains on the media. Hard drives sometimes retain residual flux that can be read by advanced tools. Advanced tools can read the remaining space on a disk, that is, the unused space in a disk cluster. Data residue occurs when erasing data on a disk.
Understand record retention policies. Records retention policies ensure that data remains available when it is needed and is destroyed when it is no longer needed. Many laws and regulations require organizations to retain data for a specific period of time, but in the absence of formal regulations, organizations determine retention periods based on policy. Audit trail data needs to be retained long enough to reconstruct past events, but organizations must determine how far back they want to investigate. A current trend among many organizations is to reduce legal liability by implementing short-term email retention policies.
Learn the difference between EOL and EOS. End of Life (EOL) is the date when a supplier announces it will stop selling a product. However, the vendor continues to support the product after EOL. End of Support (EOS) represents the date when a vendor no longer supports a product.
Explain DRM. Digital rights management (DRM) methods provide copyright protection for copyrighted works. Its purpose is to protect against unauthorized use, modification and distribution of copyrighted works.
Explain CASB. The Cloud Access Security Broker (CASB) conceptually sits between users and cloud resources. It applies internal security controls to cloud resources. CASB components can be deployed on-premises or in the cloud.
Define pseudonymization. Pseudonymization is the process of replacing certain data elements with pseudonyms or aliases. It removes private data so that the dataset can be shared with relevant parties. However, the original data is still available in a separate dataset.
Define tokenization. Tokenization replaces data elements with strings or tokens. The credit card processor replaces the credit card data with the token, and a third party holds the mapping to the original data and token.
Define anonymization. Anonymization replaces private data with useful but inaccurate data. Data sets can be shared and used for analytical purposes, but anonymization removes personal identities. Anonymization is permanent.
Understand the responsibilities of the data role. The data owner is responsible for classifying, labeling and protecting the data. The system owner is responsible for the system that handles the data. The business/mission owner owns the process and ensures the system delivers value to the organization. The data controller decides which data is to be processed and how it is processed. Data processors are generally third-party entities that process data for an organization under the direction of a data controller. Administrators grant access to data based on guidelines provided by the data owner. Users or subjects access data while performing tasks. Data custodians have day-to-day responsibilities for protecting and storing data.
Understand the security control baseline. The security control baseline provides a list of controls that can be used as a baseline by an organization. Not all baselines are suitable for all organizations. However, organizations can apply scoping and customization techniques to adapt the baseline to their own needs.
Wondershare EdrawMind
