Lecture data classification_and_data_loss_prevention
Information Systems 365/765 Information Systems Security and Strategy Lecture 3Data Classification and Data Loss Prevention
Today’s Agenda• Discuss Frontline video, “Cyberwar” and assignment #1• Discuss readings, Cyberwar, Chinese Hackers, Vendor Liability• Lecture, Data Classification and Data Loss Prevention
Readings Are Now Online• We are going to save some trees!• Readings are all at: mywebspace.wisc.edu/ndavis1/365• Readings are placed in the folders for each class session. For example, readings for Thursday, September 11, are in the September 11 folder• Link to Cyberwar video is in September 4 folder
Cyberwar Video• Overall, what did you think of the premise that both government and the private sector are at risk for cyber-attack?• Can you think of specific businesses which should be concerned about cyber-attack?
The CIA Triad• Confidentiality• Integrity• Availability• The goals of a secure information system
Confidentiality• Confidentiality is assurance of data privacy• Only the intended and authorized recipients: individuals, processes or devices, may read the data• Disclosure to unauthorized entities must be avoided• Examples - Rayovac
Ensuring Confidentiality• Encryption of data• Protecting the data with some type of authentication such as username/password• Data handling policies• Data storage policies• Data retention policies• Which of these are technical controls? Which are administrative controls?
Integrity• Integrity is assurance of data and/or source non-alteration.• Data integrity is having assurance that the information has not been altered in transmission, from origin to reception.
Source Integrity• Source integrity is the assurance that the sender of information is who it is supposed to be.• Source integrity is compromised when an agent spoofs its identity and supplies incorrect information to a recipient.
Spoofing Data and Source Integrity• Data integrity can be compromised when information has been corrupted or altered, willfully or accidentally, before it is read by its intended recipient.• We will study ways to avoid such spoofing
Ensuring Data Integrity• Digitally sign the document• Digital signature uses a checksum to ensure data integrity
How a Check Digit/Checksum Works• A check digit consists of a single digit computed from the other digits in the message.• This is accomplished with a simple formula• More complex messages require the use of a checksum
Check Digit Example• UW-Madison ID Card• The last digit is a check digit• Let’s use example “524” with a check digit of “3”, so your student ID might be “524 3”• Formula example, check digit = first digit + second digit – third digit. In this case, 5 + 2 – 4 = check digit of 3• Equipment reading your card can be programmed to make use of the check digit if it knows the formula for computing the check digit
Availability• Availability is assurance in the timely and reliable access to data services for authorized users. It ensures that information or resources are available when required.
C&I Are Nothing Without the A• Confidentiality and integrity can be protected, but an attacker causes resources to become less available than required, or not available at all.• Denial of Service (DoS)• Do you remember the DoS discussion on the video?
Ensuring Data Availability• Fully redundant network architectures and system hardware without any single points of failure ensure system reliability and robustness.• Virus scanning / malware scanning• Striping of data across hot swappable disks, mirroring data, remote live site.
CIA Summary• To secure data, you must ensure confidentiality, integrity and availability• Be careful not to compromise confidentiality and integrity as you seek to provide availability
How Do We Know If Data Should Be Protected?• Before we build a system to protect business data, we need to understand how to rate the sensitivity of business data• This is done through data classification
Data Classification• Data Classification is the conscious decision to assign a level of sensitivity to data as it is being created, amended, enhanced, stored, or transmitted.
Data Classification Levels• Top Secret• Highly Confidential• Proprietary• Internal Use Only• Public Documents• Terminology varies by organization
Top Secret• Highly sensitive internal documents e.g. pending mergers or acquisitions; investment strategies; plans or designs• Information classified as Top Secret has very restricted distribution and must be protected at all times. Security at this level is the highest possible.
Top Secret - Handling• Must sign in to gain access to the data• Must be supervised while viewing the data• Must not remove the materials from the secure viewing area• May not copy the data or even be in possession of devices which could copy the data, including pens and paper
Highly Confidential• Information that, if made public or even shared around the organization, could seriously impede the organization’s operations and is considered critical to its ongoing operations.
Highly Confidential – Handling• May only be shared with a specific list of people• May not be copied• May not leave the company’s physical location• More administrative control here than with Top Secret
Proprietary• Information of a proprietary nature; procedures, operational work routines, project plans, designs and specifications that define the way in which the organization operates.
Proprietary - Handling• May only be shared with a specific list of people• Copying is permitted but not encouraged• May be taken off-site• May not be shared with anyone outside the company
Internal Use Only• Information not approved for general circulation outside the organization where its loss would inconvenience the organization or management but where disclosure is unlikely to result in financial loss or serious damage to credibility.
Internal Use Only - Handling• Does not necessitate an authorization list• May be copied without reservation• May be taken off-site• May not be shared with the public
Public Documents• Information in the public domain; annual reports, press statements etc.; which has been approved for public use. Security at this level is minimal.
Public Documents - Handling• No distribution list required• May be copied at will• May be taken off-site• May be shared with anyone and even promoted
Data Loss Prevention (DLP) Technologies• First classify your data• Now, protect it appropriately• Control the environment• Control access to the data• Protect while in transit• Protect while in storage
Next Generation Compliance Filters• Content filters for HIPAA, GLB, SOX and other regulations automatically scan emails for protected financial and health information. Easily extensible lexicons allow companies to customize these rules to meet specific requirements.
Host Based Software• Virus Scanning on your workstation• Personal software firewalls
Appliances vs. Host Based DLP• Both provide some protection• Host based is usually more configurable, but harder to manage, especially at remote locations• Appliances are more rigid
Encryption• Protects confidentiality• Ensures recipient authentication (Only the intended recipient can decrypt the message)• We will spend an entire lecture on email encryption and YOU will send encrypted email
Content Scanning• Can be hardware or software based• HTTP traffic, viruses, malware• Phishing attempts• Peer to Peer applications• Instant Messaging• Key loggers
Enterprise Management Tools• The ability to know exactly what your users have been doing, in a form which can be audited. Web, email, etc.• The ability to control the sending and receiving of specific content.• Websense