TyscorpaData Classifications
| Government / Military | Commercial Equivalent | Description |
|---|---|---|
| Top Secret | Restricted / Confidential | Highest sensitivity; unauthorized disclosure causes grave damage |
| Secret | Private / Sensitive | Serious damage if disclosed |
| Confidential | Internal | Disclosure could damage the organization |
| Unclassified | Public | Safe for public release |
Data ownership: Data owner (business executive responsible for classification) → Data steward (enforces policies) → Data custodian (IT admin who implements controls) → Data subject (individual the data is about).
States of Data
| State | Definition | Controls |
|---|---|---|
| Data at Rest | Stored on persistent media (disk, database, cloud storage) | Full disk encryption (FDE), database encryption (TDE), file encryption (EFS) |
| Data in Transit | Moving across a network connection | TLS, IPsec, VPN, HTTPS, SSH |
| Data in Use / in Processing | Loaded into volatile memory (RAM, CPU cache) | Secure enclaves (Intel SGX), memory encryption, access controls |
Data Loss Prevention (DLP)
DLP systems monitor, detect, and block unauthorized transmission of sensitive data.
- Network DLP: Inspects traffic leaving the network (email, web uploads, cloud sync)
- Endpoint DLP: Agent on workstations controls copy/paste, USB transfers, printing
- Cloud DLP: Integrated with cloud services (Google DLP, Microsoft Purview)
- Discovery: Scans stored data to find and classify sensitive information
- Content inspection: Regex patterns for SSNs, credit card numbers, PHI keywords
DLP Use Case Example:
A hospital configures email DLP to scan outbound messages for patterns matching SSNs and ICD-10 medical codes. When detected, the email is blocked and the security team is alerted. A staff member who accidentally attaches a patient file to an external email receives an automated warning.
A hospital configures email DLP to scan outbound messages for patterns matching SSNs and ICD-10 medical codes. When detected, the email is blocked and the security team is alerted. A staff member who accidentally attaches a patient file to an external email receives an automated warning.
Digital Rights Management (DRM) / IRM
- DRM: Restricts how digital content (music, movies, ebooks) can be used — tied to a license
- IRM (Information Rights Management): Applies DRM-like controls to business documents (e.g., Microsoft Azure Information Protection)
- Prevents printing, copying, forwarding, or screenshot of protected documents
- Access can be revoked even after the document has been emailed
Data Sovereignty & Residency
- Data Sovereignty: Data is subject to the laws of the country where it is stored or processed
- Data Residency: Contractual or regulatory requirement that data must stay within a specific geographic region
- GDPR: EU data cannot be transferred to countries without adequate protection (affects US companies with EU customers)
- Cloud providers offer region-specific data storage to address these requirements
Secure Data Destruction
| Method | Description | Best For |
|---|---|---|
| Overwriting / Wiping | Multiple passes of random data over storage | HDDs being repurposed (NIST 800-88) |
| Degaussing | Strong magnetic field destroys magnetic media | HDDs, magnetic tape |
| Cryptographic Erasure | Delete the encryption key — data becomes unreadable (crypto-shredding) | Cloud storage, SSDs, self-encrypting drives |
| Physical Destruction | Shredding, crushing, incineration | Top-secret media; SSDs (overwriting is unreliable) |
Exam Tip: For SSDs, overwriting is not reliable because of wear leveling — use cryptographic erasure or physical destruction. For cloud data, the only reliable method is cryptographic erasure (destroy the key). For magnetic media: degaussing or physical destruction guarantees no data recovery.