>> Data security and the data life cycle.
The learning objectives for this lesson
are to define the data life cycle,
describe data classification and management,
and to describe data loss prevention concepts.
Let's get started. This is the data life cycle.
All data will flow through this cycle.
It begins with create.
This might be something as simple as
a user creating an email or a Word document,
but it can also be data that is created
in a database or from applications.
From there we move to store.
Once we create the data,
we have to have a place to put it.
From store we move to use.
This is making use of that data.
Then once data is no longer needed on a daily basis,
but we still need to hold onto it for a little while,
we move it to archive.
Then finally, when we no longer
have any use of the data, we destroy it.
This would complete the data life cycle.
Data classification.
All data in an organization should be classified.
This allows us to put different controls
on the data based on its classification level.
The first we have is public,
also known as unclassified.
This information, if it were to
be released or become public,
would cause no damage to the organization.
The second is confidential, also known as secret.
This data is highly sensitive and should
only be viewed by authorized personnel.
Finally, we have critical or top secret.
This information is too
important to even allow it to be captured.
The highest levels of controls are placed
upon data in this classification level.
Data management. Inventory and mapping.
This is a data map that
identifies and tracks the data created,
controlled, or maintained by an organization.
Data integrity management ensures that the data is in
its proper state and that
any changes that occur can be identified.
This ensures data reliability.
We need to know how it changed and who changed it.
Data loss prevention.
As a concept, data loss prevention or
DLP automates the discovery and
classification of data and then it enforces
rules to ensure that the data
isn't viewed or released improperly.
Once all data has been classified in an organization,
each of those levels of classification may
have specific rules placed upon them,
which users are allowed to access them,
make use of them, that sort of thing.
Data loss prevention as a software product,
it monitors endpoints and
network traffic for signs
of sensitive data that's being copied,
printed, or used in inappropriate ways.
It's comprised of a policy server,
endpoint agents, and network agents.
It works in a way that's similar
to anti-malware software.
Once it sees sensitive data,
it will either alert,
block, quarantine, or tombstone the data.
The way this would work is once you've
classified all of the data on your network,
you create those specific rules.
You can be very granular with DLP software to say,
users in this categories are allowed to view the data,
but they can't print it or they can't copy
it off to a USB device,
or they can't even email it.
Where other users may be allowed to email it,
but they're not allowed to do anything else with it.
You can be very, as I said,
granular with your rules
based on the needs of the organization.
Data loss detection.
The first example is a responsible disclosure form.
This facilitates for the easy reporting of
incidences that would occur within an organization.
The next is dark web scanning.
Oftentimes when a data breach occurs with a company,
the first signs anyone knows of
it is when the data appears in the dark web.
This usually happens when
a hacker group leaves a sample out,
either because they're going to sell
the data or they're just
releasing all the data in general.
Dark web scanning would let you look through the dark web
to see if you can find any signs of your data.
The next is deep packet inspection.
This looks into the network packets as they
pass on the network for actual data,
so we're not just looking at the source and destination,
or ports, or even the protocols,
we're looking in the actual packets
to see the data that they would contain.
Finally, we have third party.
These are services that may offer
real-time visibility into how
an organization is using its data.
Examples of this would be OneDrive and Google Drive.
Digital rights management and watermarking.
Digital rights management or DRM is about
controlling digital content and
how it's used after being published.
Most people have run into this when they've
downloaded legal music from the Internet.
Companies put DRM in there so that you're
not able to copy that and share it with others.
DVDs also make use of
stream encryption and region locking.
The overall goal is to prevent copying.
Region locking is where you
buy a DVD in the United States and then you
take it to Europe and it will not play
in the DVD players for Europe.
They're locking that DVD to
a specific region of the world.
Finally, we have watermarking.
This is marking data so that it clearly
displays important details about the data,
such as ownership information,
the data classification, and how it may be used.
Obfuscating and masking.
This is a mechanism of hiding
data and it doesn't always involve encryption,
sometimes it can be as simple as encoding things
in different formats such as base64.
The goal is to have data in a format
that isn't easily recognizable.
In my instructor side note,
I give an example of this.
Base64 is commonly used
to obfuscate payloads in phishing emails.
If you were to look at the HTML code,
often critical parts are encoded using base64.
This makes it much harder for
the end user to
tell what's going on in that phishing email.
Then it takes time to break it down,
decode it, and find out what the payload is doing.
Tokenization, scrubbing, and anonymization.
Tokenization is used in credit card processing.
This replaces the data with a token and this
cannot be reversed to go
back to the credit card information.
Scrubbing is data integrity control
that is designed to find invalid,
redundant, or outdated data
from a database or data warehouse,
if you don't need it, get rid of it.
Anonymization removes data that could be
used to uniquely identify a person.
This is common with compliance laws.
When we get into the HIPAA regulations later on,
we'll go into this a little bit more.
Summary. We described the data life cycle,
we explained data classification
and management and why that's important.
Then we also explained data loss concepts
and then we demonstrate data obfuscation and masking.
Let's do some example questions.
Question 1, what method is used to
control how digital content
is used after being published?
Digital rights management.
Question 2, which stage of the data life cycle
describes when data is no longer
used on a regular basis, but is still needed?
Archive. Question 3,
which type of data classification would be
used for information that is highly sensitive,
it should only be viewed by approved persons?
Confidential or secret. Finally,
question 4, what is used to ensure
data is in its proper state
and that any changes can be identified?
Data integrity management.
I hope this lesson was useful for
you, and I'll see you in the next one.