Jump to content

User:Torcross/Data-centric Security

From Wikipedia, the free encyclopedia


Data owners identify subsets of their Sensitive data that require protection, including circumstances that are not controlled by the owner. Data-centric security refers to protecting sensitive data items[1] independently of their state[2], of the container[3] they are kept or transported with, and of their location, by controlling what actors and in what way can access[4] each individual sensitive data item. Data-centric security approaches may involve data life-cycle[5] control and options to dynamically adjust parameters and policies pertaining to data access and life-cycle.


History[edit]

Sensitive data[edit]

The notion of data-centric security relies on that of sensitive data. These are data items[1] which immediately contain sensitive information, or which can be combined with other data to yield such information.

The most commonly known kinds of sensitive data are related to data privacy. A distinction can be made between private data, such as credit card data[6], where the knowledge of the data is controlled by the subject, and the broader set of personal data[7], such as any Personally identifiable information , in particular any Personal identifier .

There are regulations concerning data protection in general[8], as well as normative documents concerning specific branches, such as healthcare[9] or finance (e.g. psyment cards[6], or corporate compliance).

Sensitive data detection[edit]

Determining what and where sensitive data are, in an organization, involves steps that need to be repeated, at different time intervals depending on the step: First, the scope of data protection is defined, by identifying what kinds of regulations are applicable and which systems at that organization are concerned. Next, policies and technical procedures are defined, for the purpose of identifying the actually present sensitive data items[1]. The set of these items is usually too large to allow manual identification. Therefore, an automated processes for detecting these items is run regularly, following the specified policies and procedures, and using specialized Data loss prevention software.

As an example of what data are being detected, consider the following excerpt from a blog post[10] covering SSD in the context of Microsoft Server 2012 and FCI[11]: 

... people think of "documents" as Microsoft Office documents, IT admins know well that's not all that it's out there. PDF files, CAD drawings and other types of files account for a significant portion of the sensitive data ...
There are lot of classification criteria including file path, extension, size, date of creation, author, specific content, etc. The most interesting one is analyzing the content of a file for matches against custom regex-filters allowing you to search for example for:
* certain words or word combinations, or base of word, neglecting word forms, suffixes or prefixes
* specifically formatted data, for example credit card numbers, phone numbers, SSNs, PII, contract numbers, etc.
* amount of data above threshold such as more than 10 credit card numbers in one file
Basically, you can identify anything that can be expressed with a regular expression, which can go from an easy Social Security Number to formatted or unformatted credit card numbers from all the most common providers ...


Methods[edit]

Masking[edit]

Data Masking


Encryption[edit]

Tokenization[edit]

Vendors[edit]

More content ...[edit]

Notes[edit]

OLD References[edit]

RMS viewer[edit]

  • rmsviewer.com (free)[15] — only mobile, multi-platform: (iTunes) AppStore, Google Play (Android), Windows Store, (Blackberry) App World
  • Microsoft (download, free)[16] — only mobile and OS X:
... You can download the Active Directory Rights Management Services (AD RMS) mobile device extension from the Microsoft Download Center and install this extension on top of an existing AD RMS deployment. This lets users who have mobile devices and Mac computers protect and consume sensitive data when their device supports the latest RMS client and uses RMS-enlightened apps. ...
  • Apple (iTunes, free)[17] — only OS X 10.6 or later

Information-centric security[edit]

Data-centric security[edit]

DCS for data bases[edit]

  • cell-level access[23]

DCS for e-mails[edit]

  • identity-based encryption (IBE) [24] e.g. using HP Voltage technology[25][26]

DCS for documents[edit]

  1. ^ a b c A data item stands for an atomic unit of data that has precise meaning and format. This similar to, but without the attributes of a Data element. Examples: PID, date, postal address, e-mail address. A data item may be kept as the sole content of a data base entry, or it may be loosely imbedded in a document or data stream.
  2. ^ Data is considered, generally, to be at any single time in one of the following states: at rest, in use, in motion.
  3. ^ A data container stands for a technical or logical entity that can be addressed by standard procedures or software, and that contains non-atomic information kept in multiple data items, meta-data, and embedded data containers. Examples: documents, messages, streams, files, data base rows/columns/tables, personally held devices like tokens and ID cards.
  4. ^ Identity and Access Management (IAM) — definitions: "Gartner Glossary: IAM". Retrieved 2015-06-17., "TechTarget definition: IAM system". Retrieved 2015-06-17., "Microsoft Developer Netwaork: IAM". 2004. Retrieved 2015-06-17.; Wikipedia provides a list of the components of IAM.
  5. ^ Wikipedia concepts related to data life-cycle — definitions: information life-cycle, system life-cycle; applications: Data management, Data administration, Cybermethodology.
  6. ^ a b Wikipedia: PCI DSS
  7. ^ An sample definition of personal data can be taken from UK legislature: "Key definitions of the Data Protection Act"., "Data Protection Act 1998".
  8. ^ Examples of general regulations on data protection — USA: FISMA; EU: "Data protection in the EU"., "Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data". Retrieved 2015-07-14.
  9. ^ Examples of data protection regulations on healthcare — USA: HIPAA; EU: "Public health data collection in the EU". Retrieved 2015-07-14., name=HCDP:EU.ie>"European Standards on Confidentiality and Privacy in Healthcare". Retrieved 2015-07-14.
  10. ^ "Using FCI to protect files of any type with Windows Server 2012". Retrieved 2015-07-14.
  11. ^ Microsoft Server "File Classification Infrastructure": "Windows Server FCI now supports Azure RMS". Retrieved 2015-07-14., "Windows Server 2012 File Classification Infrastructure". Retrieved 2015-07-14.; involved a "Data Classification Toolkit" "Microsoft Data Classification Toolkit". Retrieved 2015-07-14..
  12. ^ "Security Guidance for Critical Areas of Focus in Cloud Computing V3.0" (PDF). Retrieved 2015-07-31.
  13. ^ "Mass Surveillance, Part 2 Technology Foresight" (PDF). Retrieved 2015-07-31.
  14. ^ "Mass Surveillance, STOA Options Brief" (PDF). Retrieved 2015-07-31.
  15. ^ "RMS Viewer - mobile document and email protection". Retrieved 2015-06-17.
  16. ^ "Active Directory Rights Management Services Mobile Device Extension". Retrieved 2015-06-17.
  17. ^ "RMS Viewer". Retrieved 2015-06-17.
  18. ^ "Business-driven data privacy policies". IBM Software. 2013.
  19. ^ Wikipedia: Data masking
  20. ^ Wikipedia: Format-preserving encryption
  21. ^ "HP Format-Preserving Encryption". Retrieved 2015-07-14.
  22. ^ "Dataguise Launches DgSecure Version 5.0". Retrieved 2015-07-14.
  23. ^ Rask; et al. (2012). "Implementing Row- and Cell-Level Security in Classified Databases". Microsoft. {{cite news}}: Explicit use of et al. in: |first1= (help)
  24. ^ Wikipedia: ID-based encryption
  25. ^ "HP SecureMail Cloud Standard". Retrieved 2015-07-14.
  26. ^ "Email Security - The IBE Architectural Advantage" (PDF). Retrieved 2015-07-14.
  27. ^ "Active Directory Rights Management Services". Retrieved 2015-07-14.
  28. ^ "Adobe LiveCycle ES4". Retrieved 2015-06-17.
  29. ^ "Specify the document permissions for users and groups". Adobe. Retrieved 2015-06-17.
  30. ^ Plastina, D. (2013-11-05). "The NEW Microsoft RMS has shipped!". The Official RMS Team Blog.
  31. ^ Plastina, D. (2013-03-04). "Windows Server FCI (File Classification Infrastructure) now supports Azure RMS". The Official RMS Team Blog.


Category:Security Category:Data security Category:Data protection Category:Information privacy Category:Information sensitivity Category:Regulatory compliance

Retrieved from "https://en.wikipedia.org/w/index.php?title=User:Torcross/Data-centric_Security&oldid=878300524"