What is Sensitive Data?
# Personally Identifiable Information: Any information lead us to an individual is a PII.
# Protected Health Information: Any data elements related to the Health Information about the individual. HIPAA protects PHI
# Proprietary Data: Confidential data belonging to an organization. Example Intellectual Property, Merger Plans, Acquisition Plans etc.
Data Classification
# Personally Identifiable Information: Any information lead us to an individual is a PII.
- Direct Identifier - SSN, Credit Card Number, Name, Email, Address
- Indirect Identifier - Zip code, City, Geolocation,
# Protected Health Information: Any data elements related to the Health Information about the individual. HIPAA protects PHI
# Proprietary Data: Confidential data belonging to an organization. Example Intellectual Property, Merger Plans, Acquisition Plans etc.
Data Classification
Government |
Private |
Damage |
Top Secret |
Confidential |
Grave Damage |
Secret |
Private |
Critical Damage |
Confidential |
Sensitive |
Serious Damage |
Unclassified |
Public |
No Damage |
Data States
# Data in Motion
Managing Sensitive Data
Marking or Labelling the Data, Secure transportation, storing sensitive data, destroying the data when no longer needed.
Methods of Removing Data
#Erasing
#Clearing
#Purging
#Sanitization
#Declassification
#Destruction
#Degaussing
Data Retention
Roles & Responsibility related to Data
#Data Owner
#System Owner
#Data Custodian
#Business Owner
#Data Processor
#Data Controller
Additional Items
#Pseudonymization
#Anonymization
#Data Masking
#Scoping
#Tailoring
# Data in Motion
- - Protect Data in Motion using TLS 1.2, VPN, IPsec etc.
- - Best protection is to encrypt it for maintaining the Confidentiality
- Encrypt Data with Advanced Encryption Standard -256 (AES-256)
- Data Masking - Think about your SSN - XXX-XX-1234, CC Number only last 4 is visible. If encryption is not possible, mask the data for the confidentiality protection.
- Tokenization - Replace the sensitive data with non sensitive data like a token.
- Generally encryption is not possible when the data is in use. We need to decrypt the data to use it for processing.
- Memory isolation for Data processing.
- Think about the stringent requirement of PCI for processing CC Data.
- Homomorphic Encryption is a method to process the encrypted Data. It's in the early stages of it's development.
Managing Sensitive Data
Marking or Labelling the Data, Secure transportation, storing sensitive data, destroying the data when no longer needed.
Methods of Removing Data
#Erasing
#Clearing
#Purging
#Sanitization
#Declassification
#Destruction
#Degaussing
Data Retention
Roles & Responsibility related to Data
#Data Owner
#System Owner
#Data Custodian
#Business Owner
#Data Processor
#Data Controller
Additional Items
#Pseudonymization
#Anonymization
#Data Masking
#Scoping
#Tailoring