Data Protection

As we think through data protection techniques, it's helpful to consider the three states where data might exist:

Data at rest is stored data that resides on hard drives, tapes, in the cloud, or on other storage media.
Data in transit is data that is in motion over a network. When data travels on an untrusted network, it is open to eavesdropping attacks.
Data in use is data that is actively in use by a computer system, including data stored in memory while processing takes place.

Data Loss Prevention

Data loss prevention (DLP) systems help organizations enforce information handling policies and procedures to prevent data loss and theft. DLP systems work in two different environments, agent-based DLP and agentless (network-based) DLP, and have two mechanisms of action, pattern matching and watermarking.

Data Minimization

If we can't completely remove data from a dataset, we can transform it through data obfuscation:

Hashing uses a hash function to transform a value in our dataset to a corresponding hash value.
Tokenization replaces sensitive values with a unique identifier using a lookup table.
Masking partially redacts sensitive information by replacing some or all sensitive fields with blank characters.

Access Restrictions

Two common types of access restrictions are geographic restrictions, which limit access based on the physical location of the user or system, and permission restrictions, which limit access based on the user's role or level of authorization.

Segmentation and Isolation

Segmentation places sensitive systems on separate networks where they may communicate with each other but have strict restrictions on their ability to communicate with systems on other networks. Isolation goes a step further and completely cuts a system off from access to or from outside networks.

10 questions.