- Welcome to lesson 12, deep dive quiz.
Now lesson 12 was all about comparing
and contrasting concepts and strategies to protect data.
So in support of that, we did three lessons.
12.1, we talked about data types;
12.2, data classification;
and 12.3, data protection
and data protection strategies.
So let's do a five question quiz together.
Make sure you have pen or pencil and a piece of paper
so you can write your answers down
and put me on pause as often as you need to.
Ready?
Let's start.
Okay, in relation to cyber,
what does jurisdiction apply to?
We're gonna choose all that apply.
Residents of data owners,
the type of data, the age of data,
the resonance of data subjects,
or the location of data and systems.
What does jurisdiction apply to?
I'm gonna choose all of them that apply.
It's take your time.
You can put me on pause.
Make those choices.
Well, we know it does apply to the residents
of the data owner.
Definitely applies to the type of data, right?
Is it medical data?
Is it healthcare data?
Is it personally identifiable data?
Doesn't really apply to how old the data is.
That's not a criteria.
It does definitely apply
to the resident of the data subject.
So for example, if you live in the EU or EEA, right?
Then GDPR will apply to you.
And it does definitely apply to where our data
and systems are.
So the location of our data and systems.
So really jurisdiction is gonna apply to all of these.
Residents of data owners, type of data,
residents of data subjects,
and location of data and systems.
The only one on this list not really applicable
is gonna be age of data.
Do you agree?
Let's check.
And that is correct.
Okay, we're gonna choose one correct answer
about classification in each dropdown list.
We have information assets
are generally classified by blank.
I'm gonna read you all the sentences
then we'll look at the list.
Infrastructure and physical assets
are generally classified by blank.
And a blank is a determination made
that an individual is eligible
to access classified information
up to a certain level.
Of course, assuming they also have a need to know.
So information assets are generally classified
by sensitivity, severity, confidentiality, or content.
How will we classifying our information assets?
Sensitivity, severity, confidentiality, or content.
I'm gonna choose sensitivity.
Infrastructure and physical assets
are generally classified by MTD, maximum tolerable downtime,
context, operational criticality, or their asset value.
So how are we going to classify
our infrastructure and physical assets?
Again, maximum tolerable downtime,
context, operational criticality, or asset value.
I hear ya.
Operational criticality.
All right, lastly.
A blank, a security clearance,
a security designation, a security assignment,
or a security classification.
And then I'm gonna close these up
so we can read it for a sec.
Is a determination made that an individual
is eligible to access classified information
up to a certain level, and I wanna keep adding,
plus having a need to know.
But what's that gonna be called?
Is that clearance, a designation,
and assignment, or a classification?
It's gonna be a security clearance.
So information assets
are generally classified by sensitivity.
Infrastructure and physical assets
are generally classified by operational criticality.
And a security clearance is a determination made
that an individual
is eligible to access classified information
up to a certain level, assuming they have a need to know.
Are you ready to check it out?
All right, and that is correct.
Let's do question three.
Data abstraction, data hiding, and steganography,
which we talked about quite a while ago,
can all be classified as this type
of data protection control.
Privacy enhancing, access management,
cryptographic, or obfuscation
Data abstraction, data hiding, and steganography, right?
How are we gonna classify them?
Privacy enhancing, access management,
cryptographic, or obfuscation.
What do you think?
Make your choice.
I'm gonna choose obfuscation.
Do you agree?
All right, let's check it out.
And it's correct.
Question four, the distinguishing feature
of this type of intellectual property
is that it remains undisclosed.
Trademark, copyright, an EULA, or a trade secret.
Okay, so the key here is, right?
That distinguishing feature is we don't see it.
It remains undisclosed.
Trademark, copyright, EULA, or a trade secret.
Remember, EULA is our end user
license agreement for software.
I think this one's pretty obvious, right?
It's the one that has secret in its name.
A trade secret.
Let's check.
And there we go.
Our last question.
We're gonna match the regulation with its constituents.
Now this is an interesting way to approach this question.
Not matching the regulation with the type of data it covers,
we're matching the regulation with its constituents.
So down the left hand side,
we have GDPR, COPPA, CCPA, HIPAA, and GLBA.
On the right hand side,
we have minors under 12, EU and EEA residents,
patients, residents of California,
and financial services customers.
So where do we wanna start?
Let's start right up here with minors under 12.
Which one of these apply to minors under 12?
I'm gonna go to COPPA.
Now you're welcome to do these with me, right?
In concert as I'm doing them,
or you know, you can always put me on pause
and finish this up.
Figure out what goes with what.
All right, what do we have next?
Here up here we have EU and EEA residents.
Well, cool, it's right across from GDPR.
So let's connect those.
Going down our list, we have patients.
That's gonna be HIPAA.
We have residents of California,
conveniently right next to it's tab right there.
And lastly, GLBA, Gramm-Leach-Bliley Act
is financial services customers.
So the regulation and the constituents.
GDPR, which is a privacy regulation, EU and EEA residents;
COPA is for collecting data of minors under 12 online;
CCPA is our California privacy regulation,
so it applies to the residents of California;
HIPAA is all about protecting medical or healthcare data,
so that would be patients;
and GLBA, Gramm-Leach-Bliley
is all about protecting financial data,
so that would be financial services customers.
You like it?
All right, let's check.
And that is correct.
Awesome, great job again.
You're doing really, really wonderful.
Just keep on going.
Up next, we're gonna explain the importance of resilience
and recovery in security architecture.
I'll see you there.