Domain-2 - Asset Security - Focussed on Data

What is Sensitive Data?
# Personally Identifiable Information: Any information lead us to an individual is a PII.

• Direct Identifier - SSN, Credit Card Number, Name, Email, Address
• Indirect Identifier - Zip code, City, Geolocation, 

# Protected Health Information: Any data elements related to the Health Information about the individual. HIPAA protects PHI

# Proprietary Data: Confidential data belonging to an organization. Example Intellectual Property, Merger Plans, Acquisition Plans etc.



Data Classification
​

Government	Private	Damage
Top Secret	Confidential	Grave Damage
Secret	Private	Critical Damage
Confidential	Sensitive	Serious Damage
Unclassified	Public	No Damage

Data States

# Data in Motion

• - Protect Data in Motion using TLS 1.2, VPN, IPsec etc.
• - Best protection is to encrypt it for maintaining the Confidentiality

# Data at Rest

• Encrypt Data with Advanced Encryption Standard -256 (AES-256)
• Data Masking - Think about your SSN - XXX-XX-1234, CC Number only last 4 is visible. If encryption is not possible, mask the data for the confidentiality protection. 
• Tokenization - Replace the sensitive data with non sensitive data like a token. 

# Data in Use

• Generally encryption is not possible when the data is in use. We need to decrypt the data to use it for processing.
• Memory isolation for Data processing.
• Think about the stringent requirement of PCI for processing CC Data.
• Homomorphic Encryption is a method to process the encrypted Data. It's in the early stages of it's development.

Managing Sensitive Data
Marking or Labelling the Data, Secure transportation, storing sensitive data, destroying the data when no longer needed.

Methods of Removing Data

#Erasing
#Clearing
#Purging
#Sanitization
#Declassification
#Destruction
#Degaussing

Data Retention



Roles & Responsibility related to Data 

#Data Owner
#System Owner
#Data Custodian
#Business Owner
#Data Processor
#Data Controller

Additional Items
#Pseudonymization


#Anonymization 

#Data Masking

#Scoping 

#Tailoring

​