In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
Data protection is a big domain. Let’s break it down into a few fundamental blocks.
Let’s start with data classification. The idea is to sort data into risk categories based on confidentiality, integrity, or sensitivity. The higher is the classification, the higher is impact of potential data loss or exposure. Classification serves as a shortcut for decision making. For example, instead of prescribing encryption mechanism for each individual application, we can have a blanket rule for the whole data category. Blanket data handling rules often go hand-in-hand with the data classification.
Secondly, we establish access rules through authorisation. Authorisation scheme could be shared, or individual per data source. Proliferation of data and data processing systems makes access control incredibly complex. Authorisation error is a common security risk related to data protection. To minimise the impact, the principle of least data is employed: “Store the least amount of data necessary to perform the intended business function.” To minimise the likelihood, the principle of least privilege is used – assign the minimum set of permissions necessary to perform the intended function.
That also applies to data lifecycle – we should proactively delete the “stale” data no longer necessary for business. Keep in mind there are regulatory requirements, which mandate a minimum data retention period for the purpose of historical investigations. Ideally, unnecessary data should be deleted as soon as the minimum retention period is served.
We will discuss data encryption at rest, special data protection techniques, and data backups separately.
Application examples
Your financial transactions are classified as confidential data, and your bank does not allow that information to be freely shared amongst bank employees.
Risks
- Mishandling – inadvertent data exposure due to a lack of understanding of the data exposure risk. It is usually addressed via user training.
- Authorisation errors – data exposure because of complexity of access rules.
- Data loss due to ransomware attack. It is addressed via disaster recovery techniques, including data backups.
- Data hoarding – violations of the principle of the least data.
Quirks
Interesting to note that data classification definition may include a risk metric, which implies that you calculate the risk first, then come up with the classification. That defeats its purpose of being a shortcut for risk decisions.
Further reading
Pocket Guide: Special data protection techniques
Pocket Guide: Encryption at Rest
[[Disaster recovery]]
Please check out the map of cyber security controls below. It is simple yet awesome.
