M4 - Confidentiality and Privacy

Confidentiality and Privacy

• Privacy protects an individual's rights and gives them control over their information.
• Confidentiality protects information from unauthorized access.
• NIST defines confidentiality as preserving restrictions on accessing and disclosing data, including protecting personal and proprietary information.

Obfuscation

• Obfuscation replaces sensitive data with less valuable data for unauthorized users.
• Methods include encryption, tokenization, and masking.

Tokenization

• Tokenization replaces sensitive data with a surrogate value (token).
• Examples include random number generators, hashing, and encryption.

Masking

• Masking swaps data to disguise identifying information.

Encryption

• Encryption is the highest level of data protection.
• Data must be encrypted at rest and in transit.

Symmetric Encryption

• Symmetric Encryption uses a single private key for encryption and decryption by all involved parties.
• This method is commonly used by banks and in Virtual Private Networks (VPNs).
• Downsides: requires sharing a private key among all parties, is complex in large-scale scenarios, and does not guarantee non-repudiation.

Asymmetric Encryption

• Asymmetric Encryption uses a public key for encryption and a private key for decryption.
• More secure, but slower than symmetric encryption, requiring more computing resources.

Hashing

• Hashing creates a one-way transformation of a message into a fixed-length hash value (message digest).

Ciphers

• Ciphers use symbols or letters to replace actual data, e.g., substitution or transposition ciphers.

Data Loss Prevention (DLP)

• DLP aims to prevent unauthorized transfer of sensitive information.
• DLP methods include pattern matching and word recognition.
• Steps for a DLP program:
  • Implement DLP program
  • Define enterprise data
  • Evaluate data types
  • Monitor sensitive data use
  • Enforce security policies
  • Implement education

DLP System Types

• Network-Based DLP: prevents outgoing data transfers on networks.
• Cloud-Based DLP: prevents outgoing data transfers in cloud environments.
• Endpoint-Based DLP: scans files on endpoint devices (printers, USB drives, laptops).

Safeguards for Data at Rest

• Physical security protects data storage hardware.
• Digital security protects data digitally.
• Authorization/Access controls manage who can access data.
• Change management governs changes to systems and data.
• Backup and recovery ensures data restoration in case of loss.

Walk-Throughs

• Walk-throughs assess program logic, design, features, and functionality.
• Read-through: review of security, confidentiality, and privacy procedures.
• Structured walk-through: role-playing or simulating a disaster scenario.
• Fire drill: simulating an emergency.
• Walk-through steps: planning & preparation, understanding, performing walk-through, documentation, testing, evaluation & report.

This quiz covers key concepts related to data privacy and security, including confidentiality, obfuscation, tokenization, and encryption methods. Test your understanding of how these practices protect individual rights and sensitive information from unauthorized access. Brush up on these essential principles for safeguarding data.