Pocket Guide: Special data protection techniques

Idea

Data protection is a big domain. In this guide, we will talk about special data protection techniques.

Let’s start with data loss prevention (DLP). It is a range of technologies, which monitor network traffic and raise alerts (or block traffic) if sensitive data is detected in transit. It is usually implemented at the network perimeter or at user machines. To achieve the outcome, a good definition of data classification is required, as well as definition of forbidden traffic directions.

Another special technique is data masking. It is a permanent or temporary modification of the data to decrease its sensitivity. A common use case is data processing in non-production environments. Such environments have relaxed security controls to allow easier test and development, which means there is a higher risk of data loss. The data is modified (masked), before it is sent to the non-production in such a way that it is still useful for testing and development, but not so useful for hackers. For example, we could replace a person’s real name with a fake one in a non-production environment.

It is possible for a data record to contain both sensitive and non-sensitive parts. PDF page, for example, cannot be broken down into parts. In this case, it is common to apply data masking (black tape, literally or digitally) to prevent staff from seeing the sensitive part of the document. This is an example of non-permanent data masking.

Close to data masking is the data tokenisation technique. Like masking, it replaces the sensitive data with non-sensitive data – token. The mapping between token and the sensitive data is maintained in a separate tokenisation system. Every time we need to obtain the sensitive data, we would need to make a request (trip) to the tokenisation system. The system then implements rigorous access controls and audit logging.

Application examples

• DLP system would prevent bank employee from sending customer information outside of the bank
• Your credit card number is typically tokenised by your bank. That protects it from merchants.

Risks

Sensitive data exposure would cause high negative business impact.

Be very careful with data handling in non-production environments. Data masking is a must there, but often overlooked. Another common mistake is application of data masking IN non-production environment – it should be applied BEFORE the data is moved into the environment.

Quirks

With IT systems increasingly moving from private datacenters into public cloud, it is becoming harder to define forbidden DLP traffic destinations. For example, attacker and our company could host data buckets on the same public cloud. When the request comes to transfer sensitive data to a bucket, the DLP system then would need to distinguish “good” vs “bad” buckets. That problem could be solved via VPC (private networking), and prohibition of non-private access to buckets. It is harder to solve for 3rd party buckets, where we don’t have private connectivity.

Another DLP quirk is it requires visibility into plaintext traffic – eavesdropping. Most of the communications nowadays are encrypted specifically to prevent eavesdropping. To get around it, network DLP systems may require installation of a blanket trusted certificate on the user’s machine. DLP then would act as the “man-in-the-middle”, decrypting the traffic, searching for sensitive data, then re-encrypting the traffic again. They may argue that is a necessary evil. In that regards DLP systems installed on the user machine are better – they inspect the traffic before it gets encrypted.

Further reading

Pocket Guide: Authorisation

Pocket Guide: General Data Protection

Pocket Guide: Encryption at Rest

[[Disaster recovery]]

Please check out the map of cyber security controls below. It is simple yet awesome.