06/09/2026 1 DPDS - Unit-1 Introduction to Data Security Dr. Bragadeesh S A 06/09/2026 2 DPDS Unit-1 Topics • Introduction • Security Policy • Policy elements and formats • Standards, procedures, guidelines • Data Breach • Data Remanence • Data Theft • W ireless Identity Theft 06/09/2026 3 Overview of Data Security • Data security - Evolved from a narrow technical discipline into a strategic organizational imperative 1950s - 1980s - Security meant physical protection of hardware 1990s - Rise of networked systems in the shifted focus to perimeter defenses — firewalls, intrusion detection, antivirus Today - Cloud computing, mobile devices, IoT, and big data, security must be embedded into every layer of an organization's digital ecosystem • W hy Data Security Matters? IBM Cost of a Data Breach Report 2023 - Average global cost of a data breach was USD 4.45 million — a record high Cybercrime damages (2025) - USD 10.5 trillion annually (Cybersecurity Ventures) Over 6 billion records were exposed in data breaches in 2021 alone Human error accounts for approximately 82% of all data breaches (Verizon DBIR 2023) • Security is not purely a technical problem — it is a governance, legal, ethical, and business continuity problem • Security failures result in financial penalties, reputational damage, loss of customer trust, regulatory fines, and in critical sectors (healthcare, energy), can endanger lives 06/09/2026 4 Information Security Principles – CIA Triad • CIA Triad - Foundational model for information security policy development and risk analysis • Consists of 3 core properties that every information security program must protect • Confidentiality (C) – Ensuring information is accessible only to those authorized to access it Mechanisms – Encryption, Access Control, Data Classification, Steganography • Integr ity (I) – Safeguarding the accuracy and completeness of the information and processing methods Mechanisms – Cryptographic Hashing, Digital Signatures, Message Authentication Codes (MACs), Version control and Audit Trails, File Integrity Monitoring (FIM) • Availability (A ) - Ensuring that authorized users have reliable access to information and systems when needed Mechanisms – Redundancy and Failover, L oad Balancing, Backups and Disaster Recovery (DR), DDoS Mitigation, Uptime SLAs 06/09/2026 5 Extended Security Principles Principle Description and Significance Authentication Verifying the identity of users, systems, or processes. Methods: passwords, MFA, biometrics, PKI certificates. Prevents unauthorized access by imposters. Authorization Determining what an authenticated user is permitted to do. Enforced via RBAC, ABAC (Attribute-Based Access Control), access control lists. Non-Repudiation Ensuring that a party cannot deny having performed an action. Achieved through digital signatures and audit logs. Critical in legal and financial contexts. Accountability Holding individuals responsible for their actions by maintaining detailed audit trails. Logs must be tamper-proof and time-stamped. Privacy The right of individuals to control how their personal data is collected and used. Governed by regulations (GDPR, HIPAA). Goes beyond security into ethics and law. Authenticity Confirming that data comes from a genuine, trusted source — not a forged or spoofed source. Enforced via digital certificates and signature verification. Resilience The ability of a system to withstand attacks and continue operating in a degraded but functional state. Goes beyond recovery to proactive fault tolerance. Least Privilege Users and systems should have the minimum level of access required to perform their functions. Limits the damage any compromised account can cause. 06/09/2026 6 Security Frameworks AAA Framework – Authentication, Authorization, Accounting • Authentication (W ho are you?): Verifying identity Multi-Factor Authentication (MFA) combines: Something you know (password/PIN) Something you have (hardware token, smart card) Something you are (biometric: fingerprint, iris scan, facial recognition) • Authorization (W hat can you do?): Defining permissions After authentication, a policy engine checks what resources the authenticated user is allowed to access and what actions they can perform • Accounting/Auditing (W hat did you do?): Recording all actions Every login attempt, file access, configuration change, and network connection is logged Audit logs - foundation of forensics and compliance 06/09/2026 7 Security Frameworks Defense in Depth: Layered Security • Implement multiple layers of control – Even if one layer fails, others still protect the system • No Single control is perfect – Layering compensated for individual control weaknesses Layer 1 — Physical Security : Fences, security guards, CCTV, biometric door locks, server room access controls. Layer 2 — Perimeter Security : Firewalls, intrusion detection/prevention systems (IDS/IPS), DMZ architecture. Layer 3 — Network Security : VLANs, network segmentation, encrypted protocols (TLS, IPSec, SSH). Layer 4 — Endpoint Security : Antivirus, EDR (Endpoint Detection and Response), host- based firewalls, disk encryption. Layer 5 — Application Security : Secure coding practices, WAF (Web Application Firewall), input validation, API security. Layer 6 — Data Security : Encryption at rest and in transit, DLP, data classification, rights management. Layer 7 — User and Identity : MFA, SSO, privileged access management (PAM), security awareness training. Layer 8 — Administrative Controls : Security policies, procedures, audits, incident response plans 06/09/2026 8 Security Policies • Enterprise Security Policy (ESP) - Formal, management-approved document that defines an organization's approach to protecting its information assets Highest-level security document and provides the foundation for all other security documents (standards, procedures, guidelines) Why Organizations Need Security Policies? • Legal and Regulatory Compliance: Laws such as GDPR, HIPAA, and CCPA require documented security practices - W ithout policies, compliance cannot be demonstrated • Consistency: Ensure that all employees, contractors, and vendors handle data consistently, reducing the likelihood of human-error breaches • Accountability: Establish clear responsibilities, so in the event of a breach, it is clear who was responsible for which control • Risk Management: Mechanism by which management formally accepts, mitigates, transfers, or avoids risk • Security Culture: Well-communicated policies build a culture of security awareness across the organization 06/09/2026 9 Core Elements of Security Policy Policy Element Description Purpose Statement W hy does this policy exist? W hat risk or compliance requirement does it address? Scope W ho and what does the policy apply to? (All employees, contractors, vendors; all systems, or specific data types?) Policy Statements The specific rules, requirements, and prohibitions. W ritten in clear, unambiguous language Roles and Responsibilities W ho is responsible for enforcing the policy? (CISO, IT Security team, system owners, employees) Compliance and Enforcement W hat are the consequences of non-compliance? (Disciplinary action, termination, legal prosecution) Exceptions Process How can exceptions to the policy be requested and approved? Review and Update Schedule How frequently is the policy reviewed? (Typically annually, or after a significant security event) Definitions Clear definitions of technical terms used in the policy References Related policies, standards, laws, and regulations that this policy is aligned with Approval and Signatures Management approval (typically CISO, CIO, or CEO sign-off ) gives the policy authority 06/09/2026 10 Security Policy Types Policy Type Coverage Acceptable Use Policy (AUP) Rules for acceptable and prohibited use of company systems, email, internet, and devices Information Classification Policy Framework for classifying data by sensitivity (Public, Internal, Confidential, Restricted) and handling rules for each Access Control Policy Rules for granting, managing, reviewing, and revoking access to systems and data Password Policy Minimum password length, complexity, expiry, reuse, and multi-factor authentication requirements Remote Access Policy Requirements for VPN usage, endpoint security for remote workers, and split tunneling rules Incident Response Policy Procedures for detecting, reporting, containing, investigating, and recovering from security incidents. Data Retention and Disposal Policy How long data must be kept, how it must be securely deleted, and what destruction standards apply Third-Party/Vendor Security Policy Security requirements that vendors and partners must meet to access organizational data or systems Bring Your Own Device (BYOD) Policy Rules for using personal devices for work, including MDM enrollment, encryption, and remote wipe capability Physical Security Policy Controls for physical access to facilities, server rooms, and equipment 06/09/2026 11 Security Policies The Policy Lifecycle • A security policy is not a static document - Follows a lifecycle: Draft: Security team drafts the policy based on risk assessment and compliance requirements Review: Legal, HR, IT, and business unit stakeholders review the draft Approval: Executive management (CISO/CIO/CEO) formally approves the policy Publish and Communicate: Policy is distributed to all affected parties. Training is conducted Enforce and Monitor: Compliance is monitored through audits, technical controls, and user reporting Review and Update: Policy is reviewed at scheduled intervals and updated when threats, technology, or regulations change Retire: Policies that are no longer relevant are formally retired and replaced 06/09/2026 12 Policy Taxonomy • Policy taxonomy - Systematic classification and organization of security documents into a coherent hierarchy Well-defined taxonomy ensures that every security requirement is documented at the appropriate level of detail and authority There are no gaps or contradictions between documents • Four-Level Security Documentation Hierarchy Level Document Type | Characteristics Example L1 - POLICIES Highest authority, management-approved, broad and general. State what MUST be done. Rarely change. All data at rest must be encrypted L2 - STANDARDS More specific than policies, define measurable requirements. State HOW MUCH or HOW W ELL. Encryption must use AES-256 or higher L3 - PROCEDURES Step-by-step instructions for implementing a policy or standard. Operational, detailed, role- specific. Step 1: Install BitLocker. Step 2: Enable AES-256 ... L4 - GUIDELINES Recommended (not mandatory) best practices. Provide flexibility. It is recommended to store encryption keys in a separate HSM 06/09/2026 13 Policy Taxonomy Standards: The Specification Layer • Standards translate policy intent into specific, measurable requirements Define minimum acceptable security configurations, algorithms, key lengths, protocols, etc Mandatory and specific, but less frequent in change than procedures Reference to external standards (ISO 27001, NIST SP 800-53, PCI DSS) W ritten for a technical audience and contain technical specifications Example Standard Statement • 'Encr yption of data at r est on por table devices must use A ES-256 in CBC or GCM mode. K ey management must use FIPS 140-2 validated har dwar e secur ity modules (H SMs). Encr yption keys must be r otated ever y 12 months.' 06/09/2026 14 Policy Taxonomy Policies: The Authority Layer • Policies are the strategic layer of security documentation Express management's intent and commitment to security W ritten in simple, non-technical language accessible to all employees Have long lifespans (years) and change only when business strategy or regulatory environment changes significantly. Typically 1-5 pages in length — concise and broad Carry the weight of organizational authority — violation can result in disciplinary action Example Policy Statement • 'A ll company data classified as Confidential or Restr icted must be encr ypted using appr oved algor ithms when stor ed on any por table device.' 06/09/2026 15 Policy Taxonomy Procedures: The Operational Layer • Procedures are the day-to-day operational instructions that tell employees exactly how to perform security-related tasks Step-by-step, sequential, and role-specific Include who does what, when, and with which tools Change frequently as technology and processes evolve Primary document used during audits and compliance reviews to demonstrate implementation Example: The Patch Management Procedure would specify: • Monitor vendor security advisories daily • Classify patches as Critical /High /Medium /L ow • Test Critical patches in the staging environment within 24 hours • Deploy Critical patches to production within 72 hours • Document patching in the ITSM ticketing system • Verify patch success and update asset inventory 06/09/2026 16 Policy Taxonomy Guidelines: The Recommendation Layer • Guidelines are non-mandatory recommendations that help employees make good security decisions in situations not specifically covered by procedures Provide flexibility in implementation while still promoting best practices Particularly useful in areas that are rapidly evolving (e.g., AI/ML security) Cannot be used as the basis for disciplinary action if not followed Example • 'It is r ecommended that employees use a passwor d manager to gener ate and stor e complex, unique passwor ds for each ser vice, r ather than cr eating passwor ds manually.' 06/09/2026 17 Additional Policy Taxonomy Categories Category Description Regulatory Policies Derived from legal requirements (GDPR, HIPAA, SOX). Mandatory compliance; non-compliance results in regulatory penalties Advisory Policies Strongly recommended practices that, while not mandatory, are expected to be followed in most circumstances Informative Policies Educational in nature; designed to inform employees about security risks and best practices without mandating specific actions Technical Policies Govern specific technical controls (e.g., firewall configuration policy, cryptography policy, software development lifecycle policy) Operational Policies Govern day-to-day security operations (e.g., incident response policy, change management policy, log review policy) 06/09/2026 18 Data Breach Stage Attacker Activity Defensive Opportunity Reconnaissanc e Attacker gathers information about the target: employee names, email formats, IP ranges, technologies in use, social media profiles, job postings (which reveal technologies used). Tools: OSINT (Maltego, Shodan), LinkedIn, Google Dorking. Minimize public exposure, monitor for scanning activity, employee awareness of social engineering. Weaponization Attacker creates or acquires a weapon: malware payload (ransomware, RAT, keylogger), exploit code for a known vulnerability, phishing email template. Patch known vulnerabilities promptly (reducing exploitable attack surface), use email security gateways to filter malicious attachments. Delivery Attacker delivers the weapon to the target: phishing email with malicious attachment or link, drive-by download via compromised website, USB drop, supply chain compromise. Email filtering, web proxies, user awareness training, endpoint protection. Exploitation The weapon executes: user clicks phishing link and malware runs, browser exploit fires, SQL injection extracts credentials. Patch management, application whitelisting, EDR, secure coding. 06/09/2026 19 Data Breach Stage Attacker Activity Defensive Opportunity Installation Attacker establishes persistence: installs backdoor, creates rogue admin account, modifies startup scripts, injects into legitimate processes File integrity monitoring, privileged access management, behavioral analytics (UEBA) Command & Control (C2) Attacker communicates with the compromised system: establishes encrypted C2 channel (often using legitimate protocols like HTTPS, DNS to blend in), receives instructions, downloads additional tools Network traffic analysis, DNS monitoring, proxy inspection of HTTPS traffic Actions on Objectives Attacker achieves their goal: exfiltrates sensitive data, deploys ransomware, destroys data, pivots to other systems, establishes long-term presence DLP, network segmentation, data classification, anomaly detection for large outbound data transfers 06/09/2026 20 Data Breach – Attack Vectors • Understanding the primary vectors through which breaches are initiated allows organizations to prioritize defensive investments Attack Vector Frequency | Examples Defenses Phishing / Social Engineering 31% of breaches (Verizon DBIR 2023). Spear phishing, BEC (Business Email Compromise), vishing (voice phishing), smishing (SMS phishing) Email security, DMARC/SPF/DKIM, security awareness training, phishing simulations. Stolen/ Compromised Credentials 49% of breaches. Password reuse, credential stuffing, dark web credential purchases MFA, Password Manager, PAM, monitoring dark web for exposed credentials. Vulnerabilities/ Exploits 26% of breaches. Unpatched systems, zero-day exploits, misconfigured cloud services Patch management, vulnerability scanning, security configuration management. Insider Threats 19% of breaches (Ponemon 2022 Cost of Insider Threats Report). Malicious insiders (data theft, sabotage), negligent insiders (mistakes, policy violations), compromised insiders (credential theft) Least privilege, UEBA, DLP, background checks.