Cyberstudy
PDF p.428 In progress

Data Protection

Open PDF at p.428 20 flashcards

Summary

PDF p.428

Classifying data as "at rest," "in motion," and "in use" is essential for effective data protection. This classification helps organizations tailor security measures to address specific risks associated with each data state, ensuring appropriate safeguards throughout the data lifecycle and facilitating compliance with data protection regulations.

In plain words

Supplementary — not from your PDF

Protect data by its state. Data at rest (in storage) uses whole disk, database or file encryption and ACLs. Data in transit (over a network) uses TLS or IPsec. Data in use (in RAM, registers, cache) can use trusted execution environments (TEEs) such as Intel SGX. Broader methods include geographic restrictions, encryption, hashing (integrity and password storage), masking, tokenization (replacing data with a token, used for payment cards), obfuscation (protecting source code), segmentation and permission restrictions.

Detailed explanation

PDF p.428
  • Data at Rest
    • Definition: Data stored in persistent storage media.
    • Examples: Financial information in databases, archived media, operational policies, system configuration data.
    • Protection Methods: Whole disk encryption, database encryption, file/folder-level encryption, access control lists (ACLs).
  • Data in Transit (Data in Motion)
    • Definition: Data transmitted over a network.
    • Examples: Website traffic, remote access traffic, data synchronization between cloud repositories.
    • Protection Methods: Transport encryption protocols like TLS or IPSec.
  • Data in Use (Data in Processing)
    • Definition: Data present in volatile memory (RAM, CPU registers, cache).
    • Examples: Documents open in applications, database data being modified, event logs being generated.
    • Protection Methods: Trusted execution environments (TEEs) like Intel Software Guard Extensions.
  • Data Protection Methods
    • Geographic Restrictions
      • Definition: Limiting data access based on geographic locations.
      • Use Case: Cloud computing and data storage services to comply with data protection laws.
    • Encryption
      • Definition: Converting data into a coded format accessible only with an encryption key.
      • Purpose: Protects data confidentiality.
    • Hashing
      • Definition: Converting data into a fixed-length string using a hashing algorithm.
      • Purpose: Verifies data integrity, securely stores passwords.
    • Masking
      • Definition: Replacing sensitive data with fictional or partially concealed values.
      • Purpose: Prevents exposure of sensitive information.
    • Tokenization
      • Definition: Replacing sensitive data with a randomly generated token.
      • Use Case: Payment processing systems to protect payment card information.
    • Obfuscation
      • Definition: Modifying data to make it difficult to understand without altering functionality.
      • Purpose: Protects source code intellectual property.
    • Segmentation
      • Definition: Dividing networks, data, and applications into isolated components.
      • Use Case: Healthcare systems to control access to patient information.
    • Permission Restrictions
      • Definition: Controlling data access based on user permissions.
      • Purpose: Reduces risk of unauthorized access and data breaches.

Important terms

taken from the text above
Data at Rest
Data stored in persistent storage media.
Protection Methods
Whole disk encryption, database encryption, file/folder-level encryption, access control lists (ACLs).
Data in Transit (Data in Motion)
Data transmitted over a network.
Data in Use (Data in Processing)
Data present in volatile memory (RAM, CPU registers, cache).
Geographic Restrictions
Limiting data access based on geographic locations.
Encryption
Converting data into a coded format accessible only with an encryption key.
Hashing
Converting data into a fixed-length string using a hashing algorithm.
Masking
Replacing sensitive data with fictional or partially concealed values.
Tokenization
Replacing sensitive data with a randomly generated token.
Obfuscation
Modifying data to make it difficult to understand without altering functionality.
Segmentation
Dividing networks, data, and applications into isolated components.
Permission Restrictions
Controlling data access based on user permissions.
TEEs Trusted execution environments

Examples & real-world scenarios

Supplementary — not from your PDF
  • TLS protecting data in transit.
  • Tokenization replacing a card number in a payment system.
  • Masking showing only the last four digits of an SSN.

Scenario

A payment system must avoid storing real card numbers. Tokenization replaces each card number with a random token, so a breach of the token store exposes no usable card data.

Common mistakes

Supplementary — not from your PDF
  • Encrypting data at rest and in transit but forgetting data in use.
  • Confusing masking (partly concealing for display) with tokenization (a random substitute value).

Practical skills

Supplementary — not from your PDF
  • Match a protection method to a data state.
  • Distinguish masking, tokenization and encryption.

What I should remember

Key Points PDF p.428
  • Data at Rest
    • Storage: Persistent media.
    • Protection: Encryption, ACLs.
  • Data in Transit
    • Transmission: Over a network.
    • Protection: Transport encryption protocols.
  • Data in Use
    • Memory: Volatile memory.
    • Protection: Trusted execution environments.
  • Data Protection Methods
    • Geographic Restrictions: Limit access by location.
    • Encryption: Coded format, encryption key.
    • Hashing: Fixed-length string, data integrity.
    • Masking: Concealed values, sensitive data.
    • Tokenization: Random tokens, secure storage.
    • Obfuscation: Difficult to understand, protect IP.
    • Segmentation: Isolated components, access control.
    • Permission Restrictions: User permissions, least privilege.