1
00:00:00,660 --> 00:00:02,580
Securing Data.

2
00:00:02,580 --> 00:00:04,110
In today's digital age,

3
00:00:04,110 --> 00:00:08,070
data security is a top priority for organizations worldwide.

4
00:00:08,070 --> 00:00:11,430
As threats continue to evolve, so too must the strategies

5
00:00:11,430 --> 00:00:14,370
and techniques used to safeguard valuable data.

6
00:00:14,370 --> 00:00:17,160
In this lesson, we're going to jump into the various methods

7
00:00:17,160 --> 00:00:20,130
used to secure data, including geographic restrictions,

8
00:00:20,130 --> 00:00:22,980
encryptions, hashing, masking,

9
00:00:22,980 --> 00:00:25,950
tokenization, obfuscation, segmentation,

10
00:00:25,950 --> 00:00:28,110
and permission restrictions.

11
00:00:28,110 --> 00:00:30,360
First, geographic restrictions.

12
00:00:30,360 --> 00:00:33,300
Geographic restrictions, also known as geofencing,

13
00:00:33,300 --> 00:00:35,130
involve setting up virtual boundaries

14
00:00:35,130 --> 00:00:38,610
to restrict data access based on the geographic location.

15
00:00:38,610 --> 00:00:41,190
This method can help organizations comply

16
00:00:41,190 --> 00:00:42,810
with data sovereignty laws

17
00:00:42,810 --> 00:00:46,140
and prevent unauthorized access from high-risk locations.

18
00:00:46,140 --> 00:00:48,150
For example, if all my employees

19
00:00:48,150 --> 00:00:49,860
are located within the Americas,

20
00:00:49,860 --> 00:00:53,010
I can simply ban any login requests originating

21
00:00:53,010 --> 00:00:54,450
from Asia or Africa

22
00:00:54,450 --> 00:00:57,870
as my users can never be logging in from those locations.

23
00:00:57,870 --> 00:00:59,640
Second, encryption.

24
00:00:59,640 --> 00:01:02,160
Encryption is a fundamental data security method

25
00:01:02,160 --> 00:01:05,069
that transforms readable data, plaintext,

26
00:01:05,069 --> 00:01:07,260
into unreadable data or ciphertext

27
00:01:07,260 --> 00:01:09,900
using an algorithm and an encryption key.

28
00:01:09,900 --> 00:01:12,600
Only those with the corresponding decryption key

29
00:01:12,600 --> 00:01:15,330
can revert the data back to its original form.

30
00:01:15,330 --> 00:01:17,940
Encryption is crucial for protecting data at rest

31
00:01:17,940 --> 00:01:19,440
and data in transit.

32
00:01:19,440 --> 00:01:20,880
Third, hashing.

33
00:01:20,880 --> 00:01:22,800
Hashing is a technique that converts data

34
00:01:22,800 --> 00:01:24,510
into a fixed size of numerical

35
00:01:24,510 --> 00:01:27,960
or alphanumeric characters, known as the hash value.

36
00:01:27,960 --> 00:01:31,110
Unlike encryption, hashing is a one-way function.

37
00:01:31,110 --> 00:01:34,500
Once data is hashed, it cannot be reversed or decrypted.

38
00:01:34,500 --> 00:01:36,870
Hashing is often used to store sensitive data

39
00:01:36,870 --> 00:01:38,790
like passwords, and it's also used

40
00:01:38,790 --> 00:01:40,740
to check the integrity of files.

41
00:01:40,740 --> 00:01:42,630
Next up, masking.

42
00:01:42,630 --> 00:01:44,670
Data masking involves replacing some

43
00:01:44,670 --> 00:01:48,300
or all of the data in a field with a placeholder, such as X,

44
00:01:48,300 --> 00:01:50,310
to conceal the original content.

45
00:01:50,310 --> 00:01:54,390
It can be done partially to keep some metadata for analysis.

46
00:01:54,390 --> 00:01:56,160
For instance, in a phone number

47
00:01:56,160 --> 00:01:57,960
the area code might be kept,

48
00:01:57,960 --> 00:02:00,180
but the rest of the number is replaced.

49
00:02:00,180 --> 00:02:01,710
Data masking can also maintain

50
00:02:01,710 --> 00:02:03,840
the original format of the field.

51
00:02:03,840 --> 00:02:06,480
Once data is masked, it's a one-way process

52
00:02:06,480 --> 00:02:07,950
so it can't be reversed,

53
00:02:07,950 --> 00:02:10,710
making it a method of de-identification.

54
00:02:10,710 --> 00:02:12,690
Next up, tokenization.

55
00:02:12,690 --> 00:02:14,640
Tokenization replaces sensitive data

56
00:02:14,640 --> 00:02:17,700
with non-sensitive substitutes, known as tokens.

57
00:02:17,700 --> 00:02:20,910
The original data is stored securely in a separate database

58
00:02:20,910 --> 00:02:24,537
with a token serving as a reference to the original data.

59
00:02:24,537 --> 00:02:28,020
Tokenization is commonly used in payment processing systems

60
00:02:28,020 --> 00:02:30,300
to protect credit card information.

61
00:02:30,300 --> 00:02:32,280
Next up, obfuscation.

62
00:02:32,280 --> 00:02:36,540
Obfuscation involves making data unclear or unintelligible,

63
00:02:36,540 --> 00:02:39,480
making it difficult for unauthorized users to understand.

64
00:02:39,480 --> 00:02:42,480
This can involve various techniques, such as encryption,

65
00:02:42,480 --> 00:02:45,240
data masking, and the use of pseudonyms.

66
00:02:45,240 --> 00:02:47,460
Next up, segmentation.

67
00:02:47,460 --> 00:02:49,440
Segmentation involves dividing a network

68
00:02:49,440 --> 00:02:52,740
into separate segments, each with its own security controls.

69
00:02:52,740 --> 00:02:55,350
This means that even if a cyber criminal gains access

70
00:02:55,350 --> 00:02:58,170
to one segment, they cannot move laterally

71
00:02:58,170 --> 00:03:00,030
to other parts of the network.

72
00:03:00,030 --> 00:03:02,670
This limits the potential damage of a breach.

73
00:03:02,670 --> 00:03:05,670
Finally, permission restrictions.

74
00:03:05,670 --> 00:03:08,340
Permission restrictions involve defining who has access

75
00:03:08,340 --> 00:03:11,250
to specific data and what they can do with it.

76
00:03:11,250 --> 00:03:13,590
This is often managed through access control list

77
00:03:13,590 --> 00:03:17,310
or role-based access control, often known as RBAC,

78
00:03:17,310 --> 00:03:19,890
by limiting access to only those who need it.

79
00:03:19,890 --> 00:03:23,010
Organizations can significantly reduce the risk

80
00:03:23,010 --> 00:03:24,810
of internal data breaches.

81
00:03:24,810 --> 00:03:26,970
So in conclusion, securing data

82
00:03:26,970 --> 00:03:28,980
is a tedious but rewarding process

83
00:03:28,980 --> 00:03:31,560
that requires a combination of techniques,

84
00:03:31,560 --> 00:03:33,870
tailored to an organization's specific needs

85
00:03:33,870 --> 00:03:35,820
and the nature of the data they handle.

86
00:03:35,820 --> 00:03:39,690
By implementing a robust mix of geographic restrictions,

87
00:03:39,690 --> 00:03:41,850
encryption, hashing, masking,

88
00:03:41,850 --> 00:03:44,730
tokenization, obfuscation, segmentation,

89
00:03:44,730 --> 00:03:46,290
and permission restrictions,

90
00:03:46,290 --> 00:03:49,590
organizations can protect their valuable data assets

91
00:03:49,590 --> 00:03:52,113
from both internal and external threats.