1
Q
What are the phases in a secure data lifecycle?
A
- Create - data is created when it is first entered into a system or modified.
- Store - act of saving data in a retrievable location (e.g. SSD)
- Use - accessing, viewing, processing of data (data handling)
- Share - access to data is granted to others
- Archive - data reaches end of useful life, but still needs to be retained (e.g. legal or compliance); placed in long-term retrievable storage
- Destroy - data is destroyed; overwriting, crypto-shredding, physical destruction (not possible in cloud)
2
Q
In the Create phase of a secure data lifecycle what are the controls?
A
- Data Classification
- Done by the creator (e.g. header/footer in a document)
- Done by system owner (e.g. all data stored in an email system is automatically classified as confidential).
3
Q
In the Store phase of a secure data lifecycle what are the controls?
A
- Protection for data in transit to storage (TLS, SSH, VPN)
- Location of data storage based on classification - governed by policies and procedures
- Access Controls (determining who has access, how it is granted)
- Encrypting data at rest
- Backups to preserve integrity and availability
4
Q
In the Use phase of a secure data lifecycle what are the controls?
A
- Data Loss Prevention (DLP) controls
- Information Rights Management (IRM)
- System access controls
- Network monitoring tools
- Logging and Monitoring
5
Q
In the Share phase of a secure data lifecycle what are the controls?
A
- Proactive Access controls (role-based auths, access granting)
- Reactive Access Controls - DLP, IRM, access review
6
Q
In the Archive phase of a secure data lifecycle what are the controls?
A
- Similar controls to Storage phase
- Additionally, periodic encryption key rotation needed
- Risk of storage medium/format becoming degraded or obsolete (affects integrity/availability)
7
Q
What is Data Dispersion?
A
Data Dispersion used in cloud computing, refers to breaking data into smaller chunks and storing them across different physical storage devices.
8
Q
What is Erasure Coding?
A
- Similar to the idea of parity bit coding
- Ability to reconstruct a lost segment of data from other segments and parity bits.
- Like solving for an unknown in algebra.
9
Q
What are the benefits/tradeoffs of Data Dispersion and Erasure Coding?
A
- Increases availability (if there is a failure of a single disk, data can be reconstructed)
- Decreases risk of compromise (if one segment of data is compromised not all is lost)
Downsides:
a) ensuring that data location does not violate data residency requirements.
b) Additional latency needed to reconstruct data.
10
Q
What are the storage type in an IaaS?
A
- Ephemeral - (e.g. EC2 Instance Store) - on the same physical host as the instance. Only exists for the lifetime of the VM. Faster access. Typically used for cache buffers, system files and memory swap files.
- Raw: Raw Device Mapping (RDM) - VMs access a particular portion of overall storage (marked by a Logical Unit Number) allocated to them.
- Long-term: Durable, persistent storage - for data archiving - e.g. S3/Glacier
- Volume: Stores data in blocks e.g. EBS.
- Object: For unstructured data (music, video files); data is stored as objects e.g. S3
11
Q
What are the storage types in a PaaS?
A
- Disk- may be volume or object store
- Databases - both a storage and a PaaS offering
- Binary Large Object (blob): for unstructured data; e.g. S3; access via URLs.
12
Q
What are the storage type in SaaS?
A
- Information storage and management; user enters data, SaaS stores in a databased managed by the CSP.
- Content and file storage (e.g. content sharing apps, ticketing systems with allow file attachments)
- Content delivery network
13
Q
What are threats to the cloud storage types?
A
- Unauthorized Access
- Unauthorized Provisioning - shadow IT
- Regulatory noncompliance - cloud services not meeting regulator requirements such as encryption algorithms.
- Jurisdictional - data crossing borders
- Denial of Service
- Data corruption or destruction
- Theft or media loss
- Malware or ransomware
- Improper disposal of media
14
Q
What is the Kerckhoff’s principle?
A
A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
15
Q
What are the stages in the lifecycle of a cryptographic key?
A
Create - use strong random number generators
Store - encrypted and stored in key vault
Use - access control and accountability
Share - not common, but using PKI to share symmetric keys
Archive - keys no longer needed for routine use, but needed for older encrypted data
Destroy - destruction of keys no longer needed.
16
Q
What are the various levels of encryption options?
A
- Storage level encryption - encryption as data is written to storage with keys controlled by CSP; normally protects data in case of theft of storage device.
- Volume level encryption - encryption as data is written to volume attached to instance; only be accessed through the OS; keys controlled by customer; protects against theft, external admin access and storage level exfiltration.
- Object level encryption - can use the following types
3a. File level encryption - e.g. MS Word/Adobe PDF using passwords or an IRM system; client encrypts
3b. Application level encryption - application encrypts data before writing to object store
- Database level encryption - maybe either file level (e.g. whole database file) or transparent encryption by the DBMS which encrypts specific columns or whole tables.
17
Q
What is hashing?
A
One-way encryption used to verify integrity of data.
Used as part of digital signatures
Digital signatures verify both authenticity and integrity of a message.
Secure Hashing Algorithm (SHA3) is an example of a hashing algorithm approved by FIPS in its Secure Hash Standard (SHS).
18
Q
What is masking?
A
Obfuscation of part of the data to keep it secure.
For e.g. displaying just the last 4 digits of the SSN.
19
Q
What is tokenization?
A
Non-sensitive representation of sensitive data.
Token is a substitute.
Normally managed via a tokenization service (which implements access controls).
20
Q
What controls comprise Data Loss Prevention?
A
- Detective Controls (identify where sensitive data is being stored and used)
- Preventative Controls (enforcing policy requirements on the storage and use of sensitive data)
- Corrective (displaying alert to user informing them of policy violation and preventing inappropriate actions).
21
Q
What are the major components of a DLP?
A
- Discovery
- Monitoring
- Enforcement
22
Q
What happens in the Discovery phase of the DLP?
A
- Identify, categorize and inventory data assets.
- Typically using network scans (IP address range, domain search)
- Data scan to identify sensitive info (eg. SSN or “Confidential” tags, or PII/PHI or Payment Info)
23
Q
What happens in the Monitoring phase of the DLP?
A
- Enables security team to identify how data is being used and prevent inappropriate use.
- Network -based v/s. Host-based DLP Monitoring
- In-motion data monitoring can be done either by N-based tools (e.g. proxy/firewall/email server) or h-based(e.g. laptop agent)
- At-rest monitoring normally done by agent-based tool
- In-use monitoring - agent-based; e.g. on a user’s laptop
- Agent-based DLP tools compatibility with OS is a concern.
- Network-based DLP concerns (remote users who bypass network, encrypted comms not visible).
24
Q
What happens in the Enforcement phase of the DLP?
A
- DLP applies rules based on the results of monitoring to enforce security policies.
- e.g. prevent a user from saving a file to removable media (USB)
25
What is data obfuscation?
- Similar to data masking/de-identification of data
- Used when sensitive data needs to be used in a different situation
- e.g. obfuscated data from production used for test systems (to simulate real world data).
26
What are some techniques to obfuscate data?
- Substitution - swap some information for other
- Shuffling - e.g.Change Chris to Hrisc
- Value Variance - Add/sub +/- $1,000
- Deletion of nullification (change to null values)
- Encryption
Note: important to maintain data integrity when obfuscating (e.g. credit card numbers must still be 16 digit numbers).
27
What is pseudo-anonymization?
Obfuscating data with the goal of reversing it - e.g. substituting an index value for PII before storing in the cloud.
28
In a PII data, what are direct and indirect identifiers?
Direct IDs are- name or identification number
Indirect IDs - are information that can be combined with other information to identify a person (e.g. demographic information and shopping history).
29
What is data de-identification?
Also known as anonymization.
Removing direct and indirect PII identifiers from datasets.
Unlike pseudo anonmyzation, this de-identification is not meant to be reversed.
30
What are the two types of data discovery?
- Data discovery by DLP tools for inventory.
| - Business Intelligence tools that analyze data for trends etc. (e.g. understanding trends to build inventory).
31
What's the difference between Data Lake and Data Warehouse?
Data Lake - unstructured data/blob
| Data warehouse - structured data or normalized data
32
What is ETL?
Extract, Transform, Load
Data from multiple disparate sources is normalized and loaded into a data warehouse.
ETL improves searchability
33
What is a Data Mart?
Data that has been warehoused, analyzed and made available for specific use by a particular business unit.
34
What is Data Mining?
Involves discovering, analyzing, and extracting patterns in data.
35
What is OLAP?
Online Analytic Processing
Analytics includes consolidation, drill-down, and slice-and-dice functions.
E.g. security incidents require forensic analysis that uses OLAP to extract relevant information from log files.
36
What is AI/ML?
AI/ML learn from data sets, improves computer algorithms by experience.
Training data is used.
37
What is structured data?
- Has a consistent format (Same info in same place)
- Example - database record
- Data may also be structured using XML tags (e.g. JSON, YAML)
- Data Schema or data model - abstract view of the data in a system.
- Easier to identify and protect PII/PHI if data is structured.
- Metadata is data that describes data
- Semantics is the meaning of the data - it is described in the data schema or data model.
38
What is unstructured data?
Information stored without following a common format.
Data labels is one approach to dealing with such data.
Content analysis is another approach.
39
What are the different types of content analysis in dealing with unstructured data?
Pattern Matching - e.g. know credit card formats, or SSN formats.
Lexical analysis - may be suited for email/IMs.
Hashing - identifies known data types - e.g. system files, compares hash of data to known hashes of sensitive files.
40
What is data classification?
- The act of forming classes or groups, by identifying common attributes.
- Data classification determines the controls/protection level needed - e.g. Public data can be unencrypted, but "Internal Use Only" data may need to be.
- Speeds up security decision making by providing risk-based security controls based on classification
41
What factors drive data classification?
- Data Type - PII, Financial, PHI, Legal, Educational etc. determines what regulations apply
- Legal Constrains - e.g. GDPR for data on EU citizens
- Ownership - shared ownership of data may impose how data is used
- Value/criticality - how loss of that data would affect an organization's operations.
42
What is data science?
The application of scientific methods and algorithms to identify knowledge or useful information from data sets.
43
What is data mapping?
Identifying data and mapping its location.
| Most DLP tools do this (scan of IP address, domain, reading tags etc.)
44
What are the different asset types that can be labeled?
1. Hard Copy Materials - labeled with a printed watermark
2. Physical assets (disc drives, servers, removable media etc.)
Risks: content of media may change; found assets may be difficult to label (cannot be read, or danger of malware)
3. Digital Files - labeled with meta data, digital water mark, footer with classification
4. Complex or shared systems - requires training and reference materials.
DLP tools are the biggest consumers of labels.
45
What elements must a data classification policy specify? (Page 71)
1. Compliance requirements inherent at various classification levels
2. Data retention and disposal requirements
3. What is considered sensitive or regulated data
4. Appropriate or approved uses of data
5. Access control and authorization
6. Encryption needs
46
What is the purpose of DRM or IRM
Digital or Information Rights Management
Controls access and usage rights when data is meant to be shared but not freely distributed.
Two types:
a) Consumer Grade IRM also known as DRM - e.g. copyrighted material such as movies, music etc. DRM tools prevent copying
b) Enterprise Grade IRM - e.g. images/documents. Also enforces usage restrictions and access rights (e.g. only users with a signed URL).
IRMs/DRMs may use ACLs to enforce restrictions.
47
What are the attributes of an IRM/DRM system?
1. Persistence - ACLs must follow the data e.g. password to open a document
2. Dynamic policy control - owner can update policy/restrictions even after sharing data; needs a connection back to an IRM server
3. Expiration - Time limited access (e.g. movie only playable for 24 hours)
4. Continuous Audit trail - for accountability
5. Interoperability - different DBs, OSs, email servers etc.
48
What are the access control models that IRM/DRMs use?
1. Discretionary Access Control - owner defines access restrictions based on document or data set.
2. Mandatory Access Control (MAC) - owner defines a classification level, and the IRM system does the rest - e.g. all sensitive data is only viewable by users with clearance.
49
What factors drive data retention?
- Organization's operational need (e.g. to support analysis for business intelligence)
- Compliance (e.g. retention of PII, Financial records).
Data retention must balance organizational needs with cost.
Cloud is generally used as a backup location. Cloud offers different storage options that balance speed of retrieval and cost.
50
What factors must data retention practices consider?
- Schedules - how long is data to be retained
- Integrity checking - ensuring that data is readable and unaltered due to environmental factors; use of hashing
- Retrieval procedures - who gets access to the data (e.g. live data needed by more users than archived data)
- Data formats - ensuring that archived data can still be read (file formats and hardware change over time).
51
Per NIST 800-88 (Guidelines for Media Sanitization) what are the three categories of delete action for defensible destruction?
1. Clear - remove data from user addressable storage (e.g. delete files, empty trash bin etc.). Renders data invisible but still recoverable using tools. Only for non-sensitive data
2. Purge - overwrite drives with dummy data or physical state change (e.g. magnetic degaussing) Expensive operation, may also degrade the physical media (e.g. overwrite 0s 35 times). Data may still be recoverable using very specialized tools. Crypto-shredding is an alternative
3. Destroy - pulverization/melting; not possible for customers to do when in cloud. More appropriate for CSPs.
52
What is a Legal Hold?
Data retention is indefinitely suspended - i.e. it must be retained even if seven years have passed (for e.g.).
Challenges with Legal Hold are a) how to identify which data to hold b) exception procedures to not delete that data c) supporting systems such as crypto keys are also not deleted
53
What are OWASP guidelines on logging?
1. Synchronize time across all servers and devices - timestamping is important to establish chain of activity
2. Differing classification schemes - e.g. some OS classify user login as "informational" while other call it "user events"
3. Identity attribution - who did what when?
4. Application specific logs - they may be in unique formats that need to be normalized
5. Integrity of log files - App and OS log files on the same hosts as the SW generating logs - hence susceptible to tampering.
54
What are SIEM tools and what do they do?
SIEM = Security Information and Event Management (e.g. Splunk)
- Log centralization and aggregation (SIEM platform gathers log data from multiple locations)
- Data Integrity - SIEM runs on a separate host with access permissions
- Normalization
- Automated or continuous monitoring (aka correlation) to identify potential attacks
- Alerting - generate tickets/emails/pages; take automated IPS actions (e.g. suspend user account)
- Investigative monitoring (log file queries, reporting)
55
What is non-repudiation?
Holding a user accountable for a particular action in a way that they cannot deny doing it.
Normally done via log files with unique ids and timestamps
56
What is chain of custody?
A defensible record of how evidence was handled and by whom from its collection to its presentation as evidence.
57
What are some of the data security technologies and strategies?
- Encryption and key management (various levels of encryption - storage, volume, object, file, app, DB)
- Hashing
- Masking
- Tokenization
- Data Loss Prevention
- Data Obfuscation
Certified Cloud Security Professional
flashcards
Decks in class (9)
# Cards
-
Domain 1 - Cloud Concepts/Architecture/Design38
-
Domain 2 - Cloud Data Security57
-
Domain 3 - Cloud Platform and Information Security30
-
Domain 4 - Cloud Application Security47
-
Domain 5 - Cloud Security Operations87
-
General Knowledge47
-
AWS Nitro Architecture10
-
Disaster Recovery - Deep Dive4
-
Domain 6 - Legal, Risk and Compliance15
