In this section of the course,
we are going to discuss data security concepts.
The data security concept section of the course
focuses on domain three, security engineering,
specifically objective 3.8,
which states that given a scenario,
you must be able to apply appropriate cryptographic use case
and/or techniques.
Ensuring the accuracy and security of information
through data security concepts is crucial
in protecting sensitive information from unauthorized access
and ensuring its integrity.
Data security concepts not only involves safeguarding data
as it moves through various stages,
but also implementing measures to uphold its reliability
and adhere to privacy standards.
Furthermore, effective and mature management
and compliance strategies help maintain data integrity
and protect sensitive information
across different systems and applications.
As we go through this section,
we'll cover many topics related to data security concepts,
including data integrity, integrity use cases, blockchain,
data protection, data state protection,
data handling and management,
and data compliance and privacy.
First, we will look at data integrity.
Data integrity ensures the accuracy, consistency,
and reliability of data throughout its lifecycle.
Data integrity ensures that data remains unaltered
without permission and is important
from the moment it is created
as well as in its storage and retrieval.
Hashing is a technique used to validate data integrity.
Hashing algorithms utilize one-way cryptographic functions
to convert any size input into a fixed-size output.
The output is known as a hash value.
A hash value uniquely represents the original data
and cannot be reverse engineered
to reveal the original data.
Important hashing algorithms include SHA, MD5,
and RACE Integrity Primitives Evaluation Message Digest,
or RIPEMD.
Overall, hashing algorithms are crucial in cryptography
for generating key material in ciphers,
creating and verifying digital signatures,
securely storing passwords,
and ensuring data integrity by producing unique hash values
that verify the authenticity of data and detect alterations.
Next, we will explore integrity use cases.
Use cases related to integrity,
involve maintaining the accuracy and trustworthiness
of data or software
to ensure its functionality and security.
Specific use cases include knowing the software providence
as well as software code integrity.
Let's explore these concepts in more detail.
Tracking and verifying the software providence
ensures the origin and history of software components
are known and secure.
Software providence helps answer the question,
"Where did this software come from and can I trust it?"
Software and code integrity ensures that software and code
have not been altered from their original and trusted state.
For example, a company developing a software application
can use providence tracking
to document the entire development process,
including who wrote each piece of code, when it was written,
and what changes have been made over time.
Alongside this, the company may implement integrity checks
through cryptographic hashes to verify the code integrity.
By combining these approaches, a company can ensure
not only that the code came from a trusted source
and followed an auditable development path,
but also that it has not been tampered with.
After that, we will look at blockchain.
Blockchain is a decentralized distributed ledger technology
that ensures data integrity and transaction transparency
by recording transactions in a series of immutable blocks.
Immutable means that the blocks are unchangeable
after creation.
An immutable database
refers to a database where data, once written,
is not able to be altered or deleted.
Immutable databases ensure a permanent record
of blockchain transaction.
For example, a blockchain based system
can be used to track supply chain transactions
where each transaction is recorded in an immutable ledger.
This provides a transparent and tamper-proof history
of goods from origin to destination.
Next, we will explore data protection.
Data protection, utilizes methods to safeguard data
from unauthorized access, alteration, or loss,
ensuring its confidentiality, integrity, and availability.
Data protection concepts include techniques
such as tokenization, cryptographic erase, obfuscation,
cryptographic obfuscation, and serialization.
Let's pause a moment to discuss each of these concepts.
The process of tokenization replaces sensitive data
with unique identifiers or tokens.
With tokenization, tokens can only be mapped back
to their original data through a secure system
preventing the exposure of sensitive information.
Cryptographic erase is the secure deletion of data
through encryption and subsequent destruction
of the encryption keys, making the data irrecoverable.
Obfuscation is used to change data
to hide its original meaning,
protecting it from unauthorized access or analysis.
Obfuscation on its own may involve encoding
to change the format of data,
but does not utilize cryptographic algorithms.
Cryptographic obfuscation, on the other hand,
transforms data into an unreadable format
using encryption algorithms.
Cryptographic obfuscation makes it difficult
for unauthorized parties to interpret or use the data.
Finally, serialization is used to convert data
into a format suitable for storage or transmission,
while preserving its ability to be accurately reconstructed
at a later time.
In practice, an e-commerce organization
might use tokenization to replace credit card information
with tokens to protect the sensitive cardholder data.
During data use, obfuscation may be used
to conceal cardholder data.
When in storage, serialization may be used
to store the sensitive cardholder data securely
and ensure that it can be reconstructed later.
When the cardholder data is no longer required
to be held in storage, cryptographic erase can be used
to ensure it is securely deleted from storage.
Following that, we will look at data state protection.
Data state protection, safeguards data
based on its current condition,
whether it is stored, being transmitted,
or being actively used.
Data state protection concepts include data at rest,
data in transit, and data in use, or in processing.
Let's discuss each of these concepts in greater detail.
The data at rest refers to data that is stored
on physical or cloud-based storage systems.
While in storage, data may be protected using encryption
and access controls to prevent unauthorized access.
Next, data in transit is defined as data
that is being actively transmitted over networks.
Data in transit is secured by using encrypted tunnels
to protect it from interception and tampering.
Next, data in use or data in processing
is data that is actively being accessed
or manipulated by applications.
Data in use or processing is located in a system's RAM
or CPU registers.
Data in use may be secured through techniques
like in-memory encryption.
In-memory encryption is the process of encrypting data
while it resides in use or processing.
Let's take a look at how an organization
can protect its data in each of these states.
The organization might use the Advanced Encryption Standard
or AES to encrypt data at rest on its servers,
ensuring that stored files and databases are secure
from unauthorized access.
The organization may then employ Transport Layer Security
or TLS to protect its data in transit across the network,
ensuring that data transmitted over the internet
or internal networks remains encrypted
and secure during transfer.
Finally, the organization might implement
in-memory encryption such as
the CPU Secure Memory Encryption feature
to protect data while it is being processed by applications,
ensuring that sensitive information remains protected
even when temporarily held in RAM.
Next, we will explore data handling and management.
Data handling and management is used to safeguard data
throughout its entire lifecycle
to ensure its confidentiality, integrity, and availability.
Data handling and management concepts
include data anonymization and data sanitization.
Data anonymization is modifying data
to prevent the identification of individual data owners
while maintaining its ability to be analyzed.
Anonymized data remains secret
even if the remaining data is exposed or shared.
For instance, removing personally identifiable information
or PII from a dataset, anonymizes the data
and allows researchers to use the data
without risking privacy breaches.
Data sanitization on the other hand,
is the process of securely destroying data
to ensure that sensitive information is completely removed
before the storage media is disposed of or repurposed.
For example, an organization may use Microsoft's
Sysinternals SDelete tool to securely destroy files
by overriding the data with random patterns,
making it irrecoverable.
Finally, we will look at data compliance and privacy.
Data compliance and privacy involves
adhering to legal and regulatory requirements
to protect and manage data in a way
that respects individual privacy
and meets legal obligations.
Data compliance and privacy concepts
include privacy applications,
legal considerations, and regulatory consideration.
Privacy applications are tools and systems
designed to safeguard personal information
and ensure it is handled according to policies
and regulations.
A privacy application's purpose is to enhance user trust
and protect data from unauthorized access.
Legal and regulatory considerations
refer to the requirements and standards
set by laws and regulations such as
the General Data Protection Regulation or GDPR,
or the California Consumer Privacy Act or CCPA.
These laws and regulations govern how organizations
must handle data.
In application, a company may use privacy applications
to ensure compliance
with the General Data Protection Regulation
by implementing data encryption and access controls,
while also following legal guidelines
to avoid penalties for non-compliance.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions
to fully ensure you can explain
why the right answers were right
and the wrong answers were wrong.
So let's get ready
to dive into data security concepts
in this section of the course.