Information Assurance and Security 2: Data Protection

Introduction to Data Protection

Data protection refers to the set of strategies and technologies used to safeguard digital information
from unauthorized access, corruption, or loss. It ensures data privacy, integrity, and availability. In
today’s digital landscape, organizations must implement robust security measures to prevent data
breaches and maintain trust.

1. Data Privacy and Compliance

A. Key Regulations and Laws
➢ General Data Protection Regulation (GDPR) – A European regulation that governs data privacy,
requiring organizations to protect personal data and uphold user rights.

Key Principles of GDPR

GDPR is built around seven core principles that guide data protection:
1. Lawfulness, Fairness, and Transparency – Organizations must process personal data
legally and transparently.
2. Purpose Limitation – Data should only be collected for specific, legitimate purposes.
3. Data Minimization – Only the necessary amount of data should be collected and
processed.
4. Accuracy – Personal data must be kept accurate and up to date.
5. Storage Limitation – Data should not be stored longer than necessary for its intended
purpose.
6. Integrity and Confidentiality – Personal data must be secured against unauthorized
access, loss, or damage.
7. Accountability – Organizations must demonstrate compliance with GDPR principles.

Examples of GDPR Enforcement

• Google (2019) – Fined €50 million for insufficient transparency in data processing.
• British Airways (2020) – Fined £20 million for a data breach affecting 400,000
customers.
• H&M (2020) – Fined €35 million for illegally monitoring employees

➢ Data Privacy Act of 2012 (Philippines) – Establishes regulations for data collection, processing,
and security in the Philippines. The implementing agency for this law is the National Privacy
Commission (NPC).

Key Principles of the Data Privacy Act

The law follows three major principles:
Principle Description
Organizations must inform individuals about how their data is
Transparency
collected, stored, and used.
 Principle Description
Legitimate
Data must be collected for a specific, legal, and necessary reason.
Purpose
Only the necessary amount of data should be collected and
Proportionality
processed.
Who is Covered by the Law?
The law applies to any person or organization that collects or processes personal data in the
Philippines or about Filipinos, including:
• Government agencies
• Private companies (banks, hospitals, schools, online platforms, etc.)
• Individuals processing personal data for business purposes
However, it does not apply to personal information used for journalistic, artistic, or research
purposes, or personal data processed for household use.

Types of Personal Data Protected

The law protects three types of data:
1. Personal Information – Any data that can identify a person (e.g., name, address, email,
phone number).
2. Sensitive Personal Information – Includes race, religion, health, education, government-
issued IDs (e.g., passport, SSS, TIN).
3. Privileged Information – Communications between individuals covered by legal
confidentiality (e.g., lawyer-client conversations).

Rights of Individuals (Data Subjects)

Under the Data Privacy Act, individuals have the right to:
1. Be informed – Know why and how their personal data is being used.
2. Access data – Request a copy of their personal information.
3. Correct data – Request corrections to inaccurate data.
4. Delete data (Right to be Forgotten) – Request deletion of their data under certain
conditions.
5. Withdraw consent – Stop companies from using their data.
6. Data portability – Request data in a format that can be transferred to another service.

➢ Health Insurance Portability and Accountability Act (HIPAA) – A U.S. law that protects sensitive
patient health information. The regulating agency for HIPAA is the U.S. Department of Health
and Human Services (HHS).

➢ The California Consumer Privacy Act (CCPA) is a data privacy law that protects the personal
information of California residents. It gives consumers more control over how businesses collect,
store, and share their data. It is regulated by the California Attorney General.

B. Principles of Data Privacy:

1. Data Minimization – Only collect the necessary amount of data required for a specific purpose.
2. Purpose Limitation – Use personal data only for the purpose it was collected.
 3. Consent Management – Obtain explicit consent from users before collecting their data.
Types of Consent in Data Privacy
o Explicit Consent – The user actively agrees (e.g., clicking "I Agree" on a privacy policy).
o Implicit Consent – Assumed based on user actions (e.g., continuing to browse a
website).
o Granular Consent – Users can choose which data is collected (e.g., selecting specific
cookie preferences).
o Informed Consent – The user is given clear information about data collection before
agreeing.
o Opt-in vs. Opt-out Consent
▪ Opt-in (default is NO, user must agree to data collection – used in GDPR)
▪ Opt-out (default is YES, user must decline – used in CCPA)

4. Data Portability – Users should have access to their data and be able to transfer it easily.
5. Accountability and Transparency – Organizations must be accountable for how they manage
personal data and inform users about their data practices.
1. Accountability
It refers to the obligation of organizations to be responsible for and demonstrate
compliance with data protection laws and principles.
2. Transparency
It means that organizations must be clear and open with individuals about how their
personal data is being collected, used, stored, and shared.

2. Data Classification and Access Control

A. Data Classification Levels:
• Public Data – Non-sensitive data that can be freely shared (e.g., press releases, public
reports).
• Internal Data – Business information not meant for public disclosure (e.g., internal emails,
company policies).
• Confidential Data – Sensitive business or personal data requiring strict access controls (e.g.,
employee records, financial information).
• Restricted Data – Highly sensitive data that, if disclosed, could cause serious harm (e.g.,
trade secrets, intellectual property).

B. Access Control Methods:

1. Role-Based Access Control (RBAC) – Assigns access permissions based on user roles.
2. Mandatory Access Control (MAC) – Uses strict security policies enforced by the organization.
3. Discretionary Access Control (DAC) – Users have the ability to grant access to others.
4. Zero Trust Security Model – Requires continuous verification of users and devices before
granting access.
5. Multi-Factor Authentication (MFA) – Adds an additional layer of security beyond just
passwords.

3. Data Encryption and Secure Storage

A. Encryption Methods:
• Symmetric Encryption (AES, DES) – Uses a single key for encryption and decryption.
Common Symmetric Encryption Algorithms
1. Advanced Encryption Standard (AES)
o Overview: AES is the most widely used symmetric encryption standard, adopted by
the U.S. government and many organizations worldwide. AES is considered highly
secure and is commonly used in encrypting data at rest (e.g., hard drives) and in
transit (e.g., HTTPS, VPNs).
o Key Sizes: AES supports three key lengths: 128-bit, 192-bit, and 256-bit, with 256-bit
being the most secure.
o Example Use Case: Encrypting files on an encrypted disk or securing data in
communication protocols like SSL/TLS.

2. Data Encryption Standard (DES)

o Overview: DES was once the standard for symmetric encryption but is now
considered obsolete due to its small key size and vulnerability to brute-force
attacks. DES uses a 56-bit key.
o Example Use Case: Historically used in financial institutions for encrypting sensitive
data like credit card information.

3. Triple DES (3DES)

o Overview: A more secure variant of DES, 3DES applies the DES algorithm three times
with different keys to enhance its security. It is considered more secure than DES
but still less efficient and secure than AES.
o Key Sizes: It uses key lengths of 112-bit or 168-bit.
o Example Use Case: Often used in legacy systems, such as in banking for encryption
of payment data.

• Asymmetric encryption is a type of encryption that uses two keys: public key which is used for
encryption (can be shared openly), private key which is used for decryption (kept secret by the
owner). The two keys are mathematically linked but cannot be easily derived from one another.
This makes asymmetric encryption highly secure for communication and authentication.

Common Asymmetric Encryption Algorithms

1. RSA (Rivest-Shamir-Adleman)
o Overview: RSA is one of the most widely used asymmetric encryption algorithms. It
is based on the mathematical properties of large prime numbers and is typically
used for encrypting small amounts of data or for securely exchanging keys.
o Key Sizes: RSA supports key sizes from 1024-bit to 4096-bit (with higher bit sizes
providing stronger security).
o Example Use Case: RSA is commonly used in SSL/TLS certificates for securing web
communications, digital signatures, and email encryption.
2. ECC (Elliptic Curve Cryptography)
 o Overview: ECC is a newer asymmetric encryption method based on the algebraic
structure of elliptic curves over finite fields. ECC provides the same level of security
as RSA but with much smaller key sizes, making it more efficient.
o Key Sizes: ECC uses smaller keys to achieve the same level of security as RSA. For
example, a 256-bit ECC key offers the same security as a 3072-bit RSA key.
o Example Use Case: ECC is widely used in mobile devices, smartphones, IoT devices,
and is increasingly used in SSL/TLS and other cryptographic systems for its
efficiency.

• End-to-End Encryption (E2EE) – Ensures that only the communicating users can read the
messages.
• Homomorphic Encryption – Allows computations to be performed on encrypted data without
decrypting it.

4. Data Integrity and Verification

Methods to Ensure Integrity
• Hashing Algorithms (SHA-256, MD5) – Create unique digital fingerprints for data verification.
It is a process that transforms input data (such as a file, password, or text) into a fixed-size string
of characters, which is typically a digest of the input.

• Digital Signatures – Authenticate the sender and ensure message integrity. It is a cryptographic
technique used to verify the authenticity, integrity, and non-repudiation of digital messages or
documents. It acts as an electronic equivalent of a handwritten signature or stamped seal but is
much more secure.

• Blockchain Technology – Provides a decentralized and tamper-proof ledger. It is a decentralized,

distributed digital ledger that records transactions across many computers so that the registered
transactions cannot be altered retroactively without the alteration of all subsequent blocks and
the consensus of the network.

• Error-Detection Codes – Identifies and corrects errors in data transmission. It is used in digital
communication systems to detect errors that may occur during data transmission or storage.
These codes introduce redundancy to the original data, allowing the system to check for the
integrity of the received or stored data.

5. Data Backup and Disaster Recovery

A. Backup Strategies:
1. Full Backup – A complete copy of all data.
2. Incremental Backup – Backs up only changes since the last backup.
3. Differential Backup – Copies all changes since the last full backup.
4. Cloud Backup – Stores backups in a remote cloud environment for quick recovery.

B. Disaster Recovery Planning:

 • Recovery Time Objective (RTO) – The maximum time allowed for system recovery. It is a critical
metric in disaster recovery planning that specifies the maximum amount of time an organization
can tolerate system downtime or disruption before it severely impacts business operations.
Essentially, RTO represents the target time within which a business function or IT system must
be restored after a disaster or unexpected disruption.

• Recovery Point Objective (RPO) – The maximum tolerable data loss in case of failure. It is a key
metric used in disaster recovery and business continuity planning. It defines the maximum
acceptable amount of data loss an organization can tolerate in the event of a system disruption
or failure. In other words, RPO represents the point in time to which data must be restored after
a disaster or interruption to ensure minimal impact on business operations.

• Business Continuity Planning (BCP) – Ensures operations can continue during a disaster.
It is a critical element of Disaster Recovery Planning (DRP). While both BCP and DRP focus on
minimizing the impact of disruptions and ensuring the organization can resume normal
operations, BCP takes a broader, more comprehensive approach, addressing how the business
will continue to function during and after a disaster, while DRP focuses more specifically on
recovering IT systems and data.

• Redundant Systems – Use failover mechanisms to prevent downtime. It is a crucial component

of Disaster Recovery Planning (DRP), providing an essential safeguard to ensure that critical IT
infrastructure and business processes can continue functioning in the event of a failure or
disaster. The concept of redundancy in DRP involves duplicating critical systems, components, or
data to create backup systems that can take over seamlessly in case the primary systems
experience a failure.

6. Secure Data Transmission

A. Methods for Secure Communication:
• Transport Layer Security (TLS/SSL) – Encrypts internet communications to prevent interception.
• Secure File Transfer Protocols (SFTP, FTPS) – Protects file transfers over a network.
• Virtual Private Network (VPN) – Encrypts network traffic to secure remote connections.
• Email Encryption – Uses encryption protocols like PGP to secure email content.

7. Insider Threats and Data Leakage Prevention (DLP)

A. Types of Insider Threats:
1. Malicious Insider – Intentionally leaks or misuses sensitive data.
2. Negligent Insider – Accidentally causes security incidents due to poor security habits.
3. Compromised Insider – Accounts hacked or credentials stolen by attackers.
B. DLP Strategies:
• Deploy endpoint protection and monitoring solutions.
• Restrict access to sensitive data based on roles.
• Implement AI-driven user behavior analytics (UBA).
• Conduct continuous security awareness training for employees.
8. Cloud Data Security
Key Considerations for Cloud Security:
• Encrypt data before uploading it to the cloud.
• Utilize secure access controls and authentication.
• Implement continuous monitoring and anomaly detection.
• Follow the Shared Responsibility Model, where cloud providers handle infrastructure security,
and users manage data security.

9. Secure Data Disposal and Retention

A. Data Disposal Methods:
• Degaussing – Erases magnetic storage data.
• Shredding – Physically destroys hard drives and storage devices.
• Secure Erasure Software – Overwrites data multiple times to ensure deletion.
B. Data Retention Policies:
• Determine how long data should be kept based on regulations.
• Regularly audit stored data and remove unnecessary files.
• Ensure compliance with industry standards and legal requirements.

10. Emerging Threats in Data Security

• Ransomware Attacks – Encrypts files and demands ransom for decryption.
• AI-Powered Cyber Threats – Uses artificial intelligence for sophisticated attacks.
• Quantum Computing Risks – Potentially capable of breaking encryption methods.
• Deepfake Attacks – Fraudulent impersonation using AI-generated media.

References;
OpenAI. (2025). ChatGPT (Mar 14 version) [Large language model]. https://chat.openai.com/chat
Perplexity AI. (2025). How to reference an AI assistant. Perplexity AI https://www.perplexity.ai/.