Data Security and Protection

1. Overview of Data Security and Protection:

• Definition: Data security is the process of protecting critical business assets (data) against unauthorized or unwanted use.

• Goal: To combine people, processes, and technology to protect data throughout its life cycle.

• Team Effort: Enterprise data protection is a collective effort involving multiple stakeholders.

2. CIA Triad (Confidentiality, Integrity, Availability):

• Confidentiality: Ensuring data secrecy, where access is restricted to authorized actors.

  • Example: A university student’s financial records are accessible to parents, but academic records are not unless authorized.

• Integrity: Ensuring data is trustworthy, accurate, and untampered.

  • Example: Only certain actors, like instructors, should be allowed to change grades.

• Availability: Ensuring data is accessible by appropriate users within a reasonable time frame.

  • Example: Academic progress information must be available during course registration but not necessarily 24/7.

3. Data at Rest vs. Data in Transit:

• Data in Transit: Data being transmitted from one point to another (e.g., over networks).

• Data at Rest: Data stored on endpoints like servers, laptops, mobile devices, and backup devices.

4. Threats to Data:

• Deliberate Attacks: Intentional actions by bad actors aiming to compromise systems and steal or damage data.

  • Types: Denial of Service, socially engineered attacks, internal and external threats.

• Inadvertent Attacks: Accidental breaches due to hardware failure, natural disasters, or human error.

• Threat Profiles: Used to predict potential threats and determine protective measures.

5. Importance of Data Protection:

• Revenue and Profits: Data breaches can cut into revenue and increase costs.

• Reputation: Breaches can damage an organization’s reputation.

• Regulatory Mandates: Legal and industry standards may impose penalties or requirements for data breaches.

• Digital Transformation: Data protection is essential for organizations moving services online or developing new offerings.

6. Key Considerations:

• Cost of Attacks: Understanding the financial impact of data breaches can be challenging, especially when assessing intangible assets like reputation.

• Security Investment: While it’s important not to overspend on security, some assets, like brand reputation, are difficult to quantify.

7. Challenges and Pitfalls:

• Data security and protection are necessary but come with significant challenges, including managing both intentional and unintentional threats and aligning security investments with asset value.