Data Protection

Once we understand what data we have and what the classification of that data is, the next step is that we need to start protecting that data. But how do we protect that data?

At this point we've created our data classification and we've labeled the data. What is going to be the next step in how we treat these different data classifications? We're going to have to create some handling procedures on how we're going to protect this data. But what are we trying to protect it from?

CIA and DAD

There are different models that we could use to figure out how we're trying to protect this different data. One of them is the CIA Triad. The CIA Triad is protecting this data for confidentiality, integrity, and availability. The reverse of this is the DAD Triad, kind of the opposite spectrum. When we're talking about confidentiality, we're talking about making sure there's no disclosure of the information, that it doesn't get revealed to those who shouldn't have access to it. Or alteration, which means that the data is not changing and is accurate. Or denial, which means that it is up and running and available for the users that are supposed to get to it. So that's the DAD Triad, looking at the opposite spectrum of that from a data perspective.

Integrity

One thing that we're really trying to protect our data from is integrity issues. Integrity is this idea that the information remains accurate, and so we don't want it to change. What could make it change is perhaps a hacker hacks in and starts changing data, or maybe there is some sort of corruption in the data itself; maybe some of our equipment's going bad and causes some corruption in it. One of these steps for integrity is just to recognize that a change has happened. So how do we recognize something has happened?

One way is we could keep duplicate copies of it. We could keep the same data twice, and by doing that, if one of the data sources changes, we'll know, because the other data source is different. Of course, then the question is, which one changed, which one is inaccurate? So maybe we need to keep three copies, and the one that does change will be evident because the other two didn't change. But that could be problematic, because now we're storing so much information. So how can we recognize something has changed without storing these large quantities of information? One answer to that is hashes. A hash is a unique fingerprint of data: we put data into it and we get a hashed value out of it, and if a little piece changes within that data, that hashed value changes as well. So we've got these unique fingerprints, and we can use hashes to determine if data is changing. If the fingerprint changes, then we know the data changed.

Another thing we could do is use a parity bit. Here's one example of a parity bit. We could take a series of bits, in this case just two bits, and then we're going to either have a one or a zero to make the addition of all these bits turn out to be an odd number. So an example here: 0 plus 0 is zero, and that's not an odd number, so we're going to add a one to make it one, which is an odd number. Here we've got 0 + 1 is 1, so that's already odd, so we're just going to have a zero there. Here's one and zero, and same result there. And a one and one is two, and we need it to be odd, so we're going to add another one and it's three, and now it creates an odd number. So that's just an example of parity bits and how a parity bit could work.

If we do find an issue with our data, then we need to clean it up. We call that data scrubbing, or data cleaning; that's the process we're going to use to fix the data to make the data right again.

Availability

We also need to make sure that our data is available, that when users need that data, they have access to it. So maybe we're implementing some sort of high availability, or maybe we have some sort of backup copies. Here's an example of some servers. They have a database on the back end. Notice that the data in this database is replicated, so we have some sort of high availability group going on with the databases here. Not only that, but we're creating a backup copy, so if something goes wrong with that, we have a backup copy. Not only that, but if something goes wrong with the site, we've also duplicated that to another site and have a whole other same setup here, so we can fail over. These are some different ways that we can create data availability with the data that we have.

One thing that can give us both a level of integrity and a level of availability is a RAID configuration. RAID is a redundant array of independent disks. Here we have disks, and we're storing data on them. RAID 1 is mirroring, where we're mirroring the data, making sure that we have a certain level of integrity and availability. RAID 5 means that we are actually striping across two disks, so we're splitting the data across two different disks, and then we create a parity disk, so that if one of these disks fails, we have kind of a backup; we can actually rebuild this data. Or, if we want to go through double, we could actually have two parity disks, which allows us to have two disks fail out of this group and we still have our system up and running.

Confidentiality

Then we have confidentiality, making sure that this information is not seen by those who shouldn't see it. One of the ways that we actually protect data is just not to have it at all; that's the ultimate way of protecting data, by deleting it or not having it to begin with. We could also limit access to it, put some barriers up so that not just anybody could access it. Or we could conceal it, hide it somehow. In the end, we really just want to make sure that our data is confidential, that it has a certain level of integrity, and that it is available.