- In 12.3, we're going to look at some specific
data protection mechanisms and strategies.
Now, how do we make decisions
about our protection mechanisms and strategies?
Well, that's data management.
Data management being the planning and execution of policies
and practices to protect data confidentiality, integrity,
and availability, there's our fundamental principles,
throughout its lifecycle.
The data protection decisions are generally related
to data classification, we talked about in the last lesson,
the data state, meaning the point in time,
data at rest, so for example, persistent storage,
disk or tape, data in use, so data that is either in RAM
or being processed by the CPU
or data in transit, data that's in transmission.
So, who's responsible for data management?
Well, there's an entire data management ecosystem, right?
The outer layer here is our directors
and executive management, our data owners
are gonna have specific responsibilities,
our data custodians are gonna have
specific responsibilities, and of course,
our data users are going to have specific responsibilities.
So let's take a look little bit deeper
about what's expected of our directors
and executive management, our data owners,
our data custodians, and our data users.
So, directors and executive management
are ultimately responsible for everything
that happens in an organization.
So, they're responsible for governance and oversight.
And from a legal and regulatory perspective,
they really are the ones that are ultimately
held responsible for the actions
or the inactions of an organization.
Now, are they doing any hands-on work?
Absolutely not, in terms of data management.
They're doing governance work, so policies and standards,
making sure that that's done, budgeting and then oversight,
getting reports to make sure that we're doing
the right thing, as well as bringing in folks
to do assessments and audits so that we have assurance
that we're doing the right thing.
The data owners, just like system owners,
are responsible for oversight and decisions.
I wanna stress those two words.
Oversight and decisions related to classification,
access control, and protection.
So again, they're responsible for oversight,
making sure that we are getting our data classified,
oversight of access control and protection
and decisions, right?
How should this be classified?
Who should have access?
And how are we going to protect it?
Now, they'll do that in concert with the data custodians.
Now, a little caveat here in a mandatory environment
that we talked about a little bit earlier,
the owners don't have a choice on classification, right?
That's done by a classification officer.
So this would be done more in a discretionary environment.
Our data custodians are responsible
for advising, implementing, managing,
and monitoring data protection controls.
So our custodians, well, that's you and me, right?
The hands-on folks, right?
We're going in, we're advising, we're implementing,
we're managing, we're monitoring.
The owners ultimately responsible for those decisions
related to classification, access control, and protection,
which also means decisions related to budgeting.
And then we get to data users.
And data users are responsible for treating data
and interacting with information systems in accordance
with organizational policies and with handling standards.
But they can't do anything
in accordance with handling standards
if we don't classify and if we don't label.
So, we have to classify our data and label our data,
so when our data users interact with that data,
they know what they're supposed to do.
So let's look at some various data protection strategies.
We have geographic restrictions, we have encryption,
we have hashing, we have segmentation.
Geographic restrictions are just gonna be
global restrictions on where data
can be stored, transmitted, and processed.
Why do we have global restrictions?
Well, for a couple reasons.
One, we might have regulations that say
your data can't be in certain places
or can only be in certain places,
or maybe we're concerned about the jurisdiction
of other places and how what laws might apply
or how local officials may be able
to get access to our data.
Encryption.
You know all about encryption now, right?
You know that we transform plain text
into encrypted text that can only be read
by the intended recipient,
meaning only the intended recipient can decrypt it.
Hashing.
You know what this is too, right?
Creating a one way fixed length representation
that's used for comparative purposes.
Really, what are we using hashing for?
We're using hashing for integrity,
where we used encryption for confidentiality.
And lastly, segmentation where we can have
network restrictions on where data
can be stored, processed, and transmitted.
Now, we've talked about all of these already,
but let me introduce you to four new ones.
Masking, tokenization, obfuscation, and access controls.
Data masking is a technique that's used
to protect sensitive data by replacing it
with either fictional or de-identified data.
The data masking techniques include
replacing identifiable data with symbols
like your password with a bunch of asterisks
or shuffling the data, or applying data substitution methods
that maintain the format of the original data.
So if you have an eight character password,
you still just see eight asterisks, right?
While hiding its content.
Now, data masking is commonly used in industries
that handle sensitive data to protect the privacy
of individuals and to comply
with data protection regulations.
Next up is tokenization and those of you
who have any interaction with having to deal
with handling credit cards, you're probably really familiar
with tokenization 'cause this is where
it just found its niche.
Tokenization is a technique to secure and desensitize data
by replacing the original data with an unrelated value
of the same length and format.
Now, the sensitive data is securely captured
and stored by a tokenization system.
The system then generates a token that's mapped
to the original data and replaces it with a token.
And that token can be used for processing or transmission
because it doesn't have any sensitive information, right?
It just has the unrelated information
that's replaced what the sensitive information was.
Now, only the tokenization system can swap the token
with the original value.
Now, unlike encrypted data, tokenized data is irreversible
and it's really widely, widely used
in the credit card processing
because there are very strict rules about how the fact
that you can't store locally credit card information, right?
Credit card name, number, you know,
the date of expiration, the security code.
But there are a lot of organizations
that that need to do recurring charges,
for example, in which case they will end up
in a tokenized environment
where the sensitive data will be held, right?
The tokenization system will have that sensitive data,
not the organizations accepting the credit card
and then they can do the swapping
when they go to do the processing.
The data obfuscation is the act of making a dataset
difficult to understand or find by unauthorized users.
And there's really two kind of approaches to this.
One is data hiding, and the other is data abstraction.
Now, data hiding is a programming technique
of hiding internal object details,
which allow for restricted access.
Where data abstraction is a programming process
of creating data types that hides the details
of the data representation,
separating the interface from the implementation.
Often data abstraction is used in programming environments.
All right, my friends, that brings us to
a three second challenge. Are you ready?
Five challenge questions, three seconds each.
Let's see if we can do it.
Number one, they're responsible for advising,
implementing, managing, and monitoring data controls.
Who is this?
This is in our ecosystem.
One, two, three.
That's gonna be our data custodians.
Number two, technique used to protect sensitive data
by replacing it with fictional or de-identified data.
One, two, three.
That's gonna be masking.
Number three, the act of making a dataset
difficult to understand or find by unauthorized users.
One, two, three.
That's gonna be obfuscation.
Number four, a cryptographic technique that creates
a one way fixed length representation of the data.
I know everybody's gonna get this right away.
One, two, three.
That's gonna be hashing.
And lastly, number five, technique to secure
and desensitize data by replacing the original data
with an unrelated value of the same length and format.
One, two, three.
I'll give you a hint, using the credit card industry.
This is a token or tokenization.
Good work.
All right, let's do a security in action
about data ownership.
It's a really short little one, isn't it?
You've been asked to explain to data owners
their data protection responsibilities
and corresponding control selection.
Pretty straightforward, right?
We have been asked to explain to data owners
what their data protection responsibilities are
and as well as corresponding control selection.
Put me on pause, jot down some notes
about what your explanation is.
I wanna know where you're gonna start this conversation.
Well, you may wanna begin by explaining that as data owners,
they're responsible for oversight and decisions
related to classification, access control,
and data protection.
Explain that data protection controls
are related to the data state, right?
Data state being, is this being processed?
Is this at rest?
Is this at transmission?
Now, this would also be a really good time
to review some recommended data protection controls.
access control, encryption, tokenization,
whatever it is that really makes sense
for your organization.
And then you wanna reassure the participants
that data custodians will be the ones to implement,
manage, and monitor the selected controls,
that their job as owners is really to approach
data management from a business perspective.
'Cause I would take this a step further and tell you
that the custodians are not only gonna implement, manage,
and monitor, but as custodians, right?
We are going to advise and educate as well.
We will help our data owners understand
what are the best controls, right?
Based on strategic alignment,
regulatory compliance, classification levels.
Again, having these conversations really, really important
because cyber and information security is not a silo.
It is an enterprise risk management activity and we need
to be able to have these conversations with folks
throughout our entire organization.
Doing all that, well, that's security in action.
There's your word cloud, and you know what to do.
Don't move on until you're really comfortable
and confident with all these terms and concepts.
When you're ready, we're gonna do a quiz together.
So I'll see you there.