Keeping Data Confidential

A key part about protecting our data and our assets is keeping it confidential.

The main ways that keeping data confidential can fall into one of three categories: don't have it, limit the access to it, or conceal it.

Data has an asset to it, a value to it, but it also has a cost or a liability. So we need to weigh out the pros and cons of keeping this as an asset and protecting it, or just deleting it altogether. Sometimes we would need to recognize that the liability is just too high and there's not a strong reason to keep it as an asset, and so therefore it needs to be deleted at that point.

Don't have it

One way to protect data is just not to have it. If we don't have the data, then the data can't be compromised.

So let's do a little scenario here. Let's say we're an e-commerce site and we need to process orders and we need to charge back the customers. Well, one way we could charge back the customers is through credit card. So if we were going to do this, first of all there is a risk to keeping data like credit card information. So first of all, maybe we don't need to collect it at all. Is there another way we could charge the customer rather than using these credit cards? So that's one way to go about it.

Another way is maybe we hand the credit card processing off to another company. They do the processing for us, so we don't need to store that data.

But perhaps maybe it's critical that we take that data. And then the question is, well, how long do we need to keep that data? So at some point in time we could delete that data. Maybe we delete the data after the transaction is complete. Maybe they're just going to come to our site one time and not really utilize our services past that, so we do the one-time charge and then delete the data, and then we're keeping that data safe essentially.

But another thing is maybe we need to keep it longer, so that way that user can come back and reuse that credit card and it's a convenient way to purchase things, or maybe it's a monthly charge. So maybe we just delete it after they're done being customers, and then we'll remove that credit card information so it's not a security vulnerability for us.

Or maybe we delete just a partial. Maybe we don't store — we just use the security code for processing, and then we delete a portion of it, just the security code, so that way we're not storing the complete credit card. So it's just a partial deletion there.

Or maybe there's some information we can replace. There's certain sensitive information out there where maybe we need to keep the rest of the data, but maybe we can replace certain parts of it. We're going to get a little more into that in another lesson.

Really this all renders down into minimizing the amount of sensitive data that we're storing to just the business purposes, just what we have to do to do business.

Limiting access

If we do have to keep the data, then we need to look at limiting access to it. A couple of ways we could limit access is we could have some sort of access control on it, or perhaps we do some sort of segmentation to the data.

Here's some different methods for access control. One, it could be user based or credential based. This is a user who has a username, a password, maybe it's some sort of two-factor authentication, where they have some sort of biometrics, where they gain access through their credentials and then they have access to the asset, or in this case to the data.

Or maybe it's certificate based. I have used certificate based to access things like networks, and so there is a certificate that you must have in order for you to be able to access certain resources.

Or maybe it's based off of a device. A lot of times we actually do this with certificates, but maybe it's some sort of device like a laptop or phone, maybe it's a one-time password device for like two-factor authentication. So there are devices we can pin things to.

There also we can have access control based off of some sort of schedule or time. Maybe it's only during working hours, and that's when the resource is available. And it could also be locked geographically, so maybe it's by IP address, maybe it's by VLAN within the company. So some sort of location based access control.

Segmentation and tokenization

Let's talk about segmentation. So in this example right here we have some web servers, then we have a database server. What we could do is we could take that database server and put it on its own network, and now it's segmented and we can control the access to those database servers. Maybe we only allow web traffic to get in there, and then maybe a couple of admins can get into it, and it's controlled by who can get to this network right here. That's one way we can segment.

There are multiple ways we can segment. For instance, within the database we can split up some of the data and segment the data within the database, so there's not interaction between maybe certain instances of this data.

Another way we can segment is something called tokenization. Tokenization allows us to replace certain data. So for instance, right here we have names, and maybe we consider the names to be the most sensitive part of this. What we can do is we can replace the name with some sort of token, and maybe it's some sort of ID. So 1 2 3 4 5 8 n maybe is the ID for this one, and then we have a lookup table, so we put that data into here — 1 2 3 4 — and then the name, and in this case it's Alex. And then we segment this data on another system.

Now what happens is, if this was ever compromised, they wouldn't get people's names involved with this. What they would have to do is they'd have to compromise two different segments here in order to gain access. And then we have some sort of system that brings this data together when it's called for, when the data needs to be brought together. And the token on this — this is the token — and so that's why it's called tokenization.

Concealing data

We also said we could conceal it, so let's talk about how we can conceal data. Some examples would be encryption, where we take the data and we encrypt the data so it's still present. Perhaps people still have access to the data, but it's unreadable unless you have the key to decrypt this.

Another way that we can hide data or conceal data is through steganography, where we can take data and imprint it onto something like a picture or audio file or some other type of file, and we can then conceal certain data within it.

We also have masking or obfuscation, where we take data and we obscure that data to the point where it's not really feasible, or doesn't have value, to somebody that might leverage that data.