Data Security PDF

Certified Cybersecurity Technician Exam 212-82 Data Security Data Security Data security inv...

Certified Cybersecurity Technician Exam 212-82 Data Security Data Security Data security involves the application of various data security controls to prevent any intentional or unintentional act of data misuse, data destruction, and data modification 9L LJ L} Three Critical States of Data in Use Data Security Workstations ¢ Laptops o Data at Rest ‘ Data in Rest |I = - — 1]= pra P = v N g ==.. A NN —— —1 - = Data in Use = —= Databases/Repositories 0 Data in Transit Y H. -.. Firewall 6’ | I \ Workstations | Data in Rest @ Internet Internet Data in Rest @ Copyright © by EC L. All Rights Reserved. Reproduction Reproduction isis Strictly Prohibited Data Security Data security involves the application of various data security controls to prevent any intentional or unintentional act of data misuse, data destruction, and data modification. An organization's data is considered to be secured when they have sufficient provisions for: = Restricting data from intentional or accidental destruction, modification, or disclosure = Recovering lost or modified data following incidents = appropriate data retention and destruction policies Three Basic States of Data = Data at rest: This data is inactive and is stored on a device or a backup medium such as hard drives, laptops, backup tapes, mobile devices, or at the offsite cloud backup. Data at rest remains in a stable state. The data at rest will not move actively in a system or network and cannot be accessed by an application or program. = Data in use: This data is stored or processed by RAM, CPUs, or databases. It is not passively stored on the system, but actively moves across IT infrastructure. It is updated, erased, processed, accessed, and/or read by the system. = Data in transit: This data actively moves from one location to another across the network, or is encrypted before moving and/or being transmitted through encrypted connections such as HTTPS, SSL, transport layer security (TLS), FTPS, etc. Module 15 Page 1750 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Exam 212-82 Data Security Data in Use Workstations @ Laptops — @ Laptops =l Data in Rest | o4 && S I Y b =k S ~— Y Y Databases/Repositories Rl. Firewall @ _ Workstations ‘www’ Internet Data in Rest Figure 15.2: Three basic states of data Module 15 Page 1751 Certified Cybersecurity Technician Copyright © by EG-Gouncil EC-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Exam 212-82 Data Security Example: “Data at Rest” vs “Data in Use” vs “Data in Transit” a @ Proper implementation of data security measures are required in each state to proactively enhance data security ‘.“ /V4| sit I- Inactive data stored in digitally Data traversing using some means Description at a physical location e Deta stored in Y of communication Customer bank balance stored :- Examples Examples S e PR Data stored in RAM An email being sent =/« Data encryption *= Authentication techniques eG S5 andTiS. ht control on this data’s Security *= Password protection :':cessibllity :?cessibility *. :an:il encryption Email e:;gm::n tools such as Controls - Tokenization o S s PGP or S/MIME Controls LA * Full memory encryption - " d - * Firewall controls R Sl = Strong identity management Example: “Data at Rest” vs “Data in Use” vs “Data in Transit” A proper implementation of security measures is required in each state to proactively enhance data security. The following table describes the various states of data, their specific examples, and security controls to protect against attacks. Data at Rest Data in Use Data in Transit Inactive data stored in Data traversing using Description | digitally at a physical Data stored in memory some means of location communication |. P Examples Custom.er s Custom'er Dt Banee Data stored in RAM An email being sent stored in database = Authentication Authentication hni. hni. == Data encryption Data encryption :echnlques o.trechmques : 1 * SSLand TLS SSLandTLS. = Tight control on this = Email encryption i = Password protection , e -~ 25:::;:‘ zcex::\l::)tl‘:’s it. el t‘p t.p data’s accessibility tools such as PGP or P S |on' |on. * Full memory encryption S/MIME " PaiSicoeio Boticncnmon = Strong identity =* Firewall controls management Table 15.1: Data at rest vs Data in use vs Data in transit Module 15 Page 1752 Certified Cybersecurity Technician Copyright © by EG-Gouncil EG-Bouncil All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Exam 212-82 Data Security Information Management Lifecycle e o LV ART ) @e =) L E LX) "'f::fi:: (R LI ma— @ - ) The management of information helps organizations meet legal, compliance, and competitive requirements 7N /\\ Creation EN { Erasure ’‘ Organization Information lifecycle management monitors and tracks the ‘- o passage of information through several stages from creation to l.- "N destruction Storage ‘ {[ Utilization o Effective information lifecycle management has enormous benefits for organizations such as reduced risks and cost, enhanced services, and effective governance Copyright © by All Rights Reserved. ReproductionIs Strictly Prohibited. Information Management Lifecycle The information management lifecycle helps organizations meet legal, compliance, and competitive requirements. Information lifecycle management monitors and tracks the passage of information through several stages from creation to destruction. A lifecycle management policy protects the integrity of data throughout the lifecycle processes. Effective information lifecycle management has enormous benefits for organizations such as reduced risks and cost, enhanced services, and effective governance. Information passes through a series of stages. Information lifecycle management involves the monitoring and tracking all these stages to verify that the data are managed properly. Although no common list of stages is used, variations include similar operations. The following are the various stages of the information lifecycle. =» Creation/gathering: In this stage, the information is gathered in a manageable environment. The data can be generated internally by automated sources or employees as well as by outside sources such as vendors and clients. Metadata creation is also performed in this stage for later identification. =* Organization: The information can be stored at one or many locations. In the case of critical information, control over distribution and storage protection is mandatory. The information can also be classified and tagged in this stage. = Utilization: Occasionally, the data need to be transferred to new locations or converted to new formats, or more metadata need to be added. In such cases, all necessary developments and modifications are performed in this stage to ensure that the data are useful and available for authorized users or accounts. Module 15 Page 1753 Certified Cybersecurity Technician Copyright © by EC-Council EG-Council All Rights Reserved. Reproduction is Strictly Prohibited. Certified Cybersecurity Technician Exam 212-82 Data Security = Remediation: Information must often be migrated and converted so that software products can utilize it effectively. It is mandatory to maintain integrity while performing these activities and to follow remediation methods in case of problems. = Storage/retention: Occasionally, information that is not useful at present must be archived. The archived data can be used later for regulatory purposes. Archival policies minimize the amount of data information systems can manage and allow secure retention. The data can be restored from archives when required. * Erasure/destruction: When information is no longer useful and need not be archived, it should be formatted or erased permanently without leaving any residue. Destruction { Creation N N\ N Erasure Organization Storage [ Utilization Remediation / \ Figure 15.3: Information management lifecycle Module 15 Page 1754 Certified Cybersecurity Technician Copyright © by EG-Council All Rights Reserved. Reproduction is Strictly Prohibited.