Digital Forensics and Incident Response | DFIR
  • Blog
  • Infosec
  • Windows Forensics
  • Mac Forensics
  • Memory Forensics
  • Incident Response
  • CISSP
  • Blog
  • Infosec
  • Windows Forensics
  • Mac Forensics
  • Memory Forensics
  • Incident Response
  • CISSP

Domain-2 - Asset Security - Focussed on Data

1/21/2022

0 Comments

 
What is Sensitive Data?
# Personally Identifiable Information: Any information lead us to an individual is a PII.
  • Direct Identifier - SSN, Credit Card Number, Name, Email, Address
  • Indirect Identifier - Zip code, City, Geolocation, 

# Protected Health Information: Any data elements related to the Health Information about the individual. HIPAA protects PHI

# Proprietary Data: Confidential data belonging to an organization. Example Intellectual Property, Merger Plans, Acquisition Plans etc.



Data Classification
​
Government
Private
Damage
Top Secret
Confidential
Grave Damage
Secret
Private
Critical Damage
Confidential
Sensitive
Serious Damage
Unclassified
Public
No Damage
Data States

# Data in Motion
  • - Protect Data in Motion using TLS 1.2, VPN, IPsec etc.
  • - Best protection is to encrypt it for maintaining the Confidentiality
# Data at Rest
  • Encrypt Data with Advanced Encryption Standard -256 (AES-256)
  • Data Masking - Think about your SSN - XXX-XX-1234, CC Number only last 4 is visible. If encryption is not possible, mask the data for the confidentiality protection. 
  • Tokenization - Replace the sensitive data with non sensitive data like a token. 
# Data in Use
  • Generally encryption is not possible when the data is in use. We need to decrypt the data to use it for processing.
  • Memory isolation for Data processing.
  • Think about the stringent requirement of PCI for processing CC Data.
  • Homomorphic Encryption is a method to process the encrypted Data. It's in the early stages of it's development.

Managing Sensitive Data
Marking or Labelling the Data, Secure transportation, storing sensitive data, destroying the data when no longer needed.

Methods of Removing Data

#Erasing
#Clearing
#Purging
#Sanitization
#Declassification
#Destruction
#Degaussing

Data Retention



Roles & Responsibility related to Data 

#Data Owner
#System Owner
#Data Custodian
#Business Owner
#Data Processor
#Data Controller

Additional Items
#Pseudonymization


#Anonymization 

#Data Masking

#Scoping 

#Tailoring

​

0 Comments



Leave a Reply.

    Author

    Write something about yourself. No need to be fancy, just an overview.

    Archives

    June 2022
    January 2022
    October 2021
    September 2021
    July 2021

    Categories

    All
    Domain8

    RSS Feed