CCSK · Domain 5
Data Security
About 14% of the exam
The data security lifecycle
- Create
- Store
- Use
- Share
- Archive
- Destroy
- Create
- classify and label immediately
- Store
- encrypt and restrict access
- Use
- monitor, mask and log
- Share
- control what leaves the boundary
- Archive
- long retention, keys kept alive
- Destroy
- cryptographic erasure with evidence
- Phases repeat
- the order is not strict
- Actors and places
- map who touches it where
Label the data at creation, because every later control decides what to do by reading that label
Storage by service model
- IaaS volume
- block storage attached to instances
- IaaS object
- flat namespace reached by interface
- PaaS database
- structured rows behind a service
- PaaS analytics
- large unstructured datasets
- SaaS content
- documents inside the application
- Ephemeral disk
- vanishes with the instance
- Cold tier
- cheap, slow, often immutable
- Delivery cache
- copies sitting at the edge
Discovery and classification
- Find data by metadata and content
- Pattern matching plus checksum validation
- Exact matching needs a fingerprint index
- Labels must survive copy and export
- Owner classifies, custodian protects
- Automation acts on the label
- Unlabeled data defaults to sensitive
Where encryption sits
- In transit
- protected between every hop
- Provider side at rest
- volume or object encryption
- Database level
- transparent, column or application
- Client side
- provider never sees plaintext
- In use
- confidential computing enclaves
- Field level
- portable across providers
- Deterministic mode
- leaks equality between values
- Convergent mode
- enables deduplication, leaks content
Key custody models
- Provider managed
- easiest, provider can decrypt
- Customer managed
- you set policy and rotation
- Bring your own key
- you generate, provider stores
- Hold your own key
- key never leaves your premises
- External key manager
- provider calls out to decrypt
- Hardware security module
- tamper resistant validated hardware
- Access justification
- external approval per decryption
- Escrow
- recovery copy held elsewhere
Obfuscation techniques
Tokenization
- Random token with no mathematical link
- A vault maps the token back
- Shrinks the regulated scope
- Format preserving keeps field shape
Masking
- Static masking for test copies
- Dynamic masking by role at query
- Referential integrity is the hard part
- Realistic but fictitious values
Anonymization
- Direct and indirect identifiers removed
- Pseudonymous data is still personal
- Hiding in a crowd of similar records
- Calibrated noise trades utility away
Envelope encryption
- A data key encrypts the actual data
- A wrapping key protects the data key
- Only the small key reaches the service
- Rotate the wrapping key and rewrap
- Bulk data never needs re-encryption
- Caching data keys trades safety for speed
Secrets management
- Secrets separate from code and images
- Short lifetime limits the leak window
- Automatic rotation with no downtime
- Every retrieval is logged
- Workload identity replaces stored credentials
- Dynamic credentials issued per session
Data loss prevention
- Discover, monitor and enforce
- Covers data at rest, motion and use
- Policies built from classification labels
- Client side encryption blinds inspection
- Access brokers extend coverage to SaaS
- Tune hard to cut false positives
Deletion and retention
- Retention set by law and policy
- The longest applicable period wins
- Legal hold overrides scheduled deletion
- Physical destruction is not available
- Destroy the key to destroy the data
- Contract for evidence of deletion
Residency and replication
- Replication creates copies in new places
- Backups follow their own geography
- Delivery caches copy data outward
- Pin regions with policy, not intent
- Keys and data can live apart
- Sovereign controls limit operator access
Data security failures
- Object store opened to the public
- Snapshot copied to an unmanaged account
- Deduplication side channel reveals content
- Test environment loaded with production data
- Keys written into application output
- Deleted data still in an old backup
Rapid recall: protection choice
- Provider must never decrypt
- hold your own key
- Keep the field format
- format preserving tokenization
- Populate a test database
- static masking
- Publish a research dataset
- differential privacy
- Unalterable for seven years
- immutable object storage
- Delete from shared disks
- cryptographic erasure
- Control after sharing
- rights management
- Find regulated data at rest
- content aware discovery
Reference strip: lifecycle, encryption, custody, obfuscation, governance
Lifecycle
- Create with a label
- Store encrypted and restricted
- Use with monitoring
- Share is the riskiest phase
- Archive then destroy by policy
Encryption
- In transit, at rest, in use
- Client side beats provider side
- Envelope encryption everywhere
- Deterministic modes leak equality
Key custody
- Provider managed to hold your own
- Hardware modules for strict custody
- Rotation keeps the old material
- Keys stored apart from data
Obfuscation
- Tokenization has no math link
- Masking static or dynamic
- Pseudonymous is still personal
- Noise budgets trade utility
Governance
- Retention and legal hold
- Cryptographic erasure to destroy
- Region pinning for residency
- Evidence of deletion contracted
Quick exam traps
- Trap: Pseudonymized records are no longer personal data
- Trap: Provider managed encryption stops the provider reading your data
- Trap: A token can be reversed with the right algorithm
- Trap: Overwriting or degaussing is how you destroy cloud data
- Trap: Rotating a key lets you delete the previous version at once
- Trap: Encrypted data is exempt from residency requirements
- Trap: Store is the riskiest phase of the data lifecycle
cybercertprep.com · original revision sheet written from the public body of knowledge