L19. Data Privacy, Classification & Handling
Course outlineLesson 19 of 20
Data is the asset most organizations exist to protect. Knowing how to classify data, enforce appropriate handling procedures, and apply data loss prevention controls is essential for Security+ and real-world security roles.
Data Classification
Data classification assigns sensitivity labels that determine handling requirements. Higher sensitivity = stricter controls, limited access, and stronger encryption. Government classification (US):
- Top Secret: unauthorized disclosure could cause exceptionally grave damage to national security
- Secret: serious damage
- Confidential: damage
- Unclassified: no restriction
- Restricted/Confidential: trade secrets, financial data, PII, PHI
- Internal: business information for employees only
- Public: information intentionally made public
Data Types
PII (Personally Identifiable Information): any data that can identify an individual (name, SSN, email, IP address, biometrics). PHI (Protected Health Information): health data tied to an individual; regulated by HIPAA. PCI data: payment card numbers, CVV codes, cardholder data; regulated by PCI-DSS. Intellectual property: trade secrets, source code, patents; regulated by NDAs and trade secret law.Data Loss Prevention (DLP)
DLP monitors and enforces policies to prevent unauthorized data exfiltration:
- Network DLP: inspects outbound traffic for sensitive data patterns (SSN, credit card numbers)
- Endpoint DLP: monitors data movement on devices (copy to USB, print, screenshot)
- Cloud DLP: integrated with cloud services (Google Workspace DLP, Microsoft Purview)
Data Destruction
When data is no longer needed, it must be destroyed so it cannot be recovered:
| Method | Applies To | Notes |
|---|---|---|
| Physical shredding | Paper, storage media | Most certain for physical media |
| Degaussing | Magnetic media (HDD, tapes) | Destroys data and the drive |
| Cryptographic erasure | Encrypted drives (SSD, cloud) | Delete the encryption key; data becomes irrecoverable |
| Secure erase (NIST 800-88) | SSDs | Multiple overwrite passes |
- ✓Data classification determines handling requirements: higher classification = stricter controls and more limited access
- ✓DLP prevents exfiltration by inspecting content and enforcing policy; deployed at network, endpoint, and cloud layers
- ✓PII includes any data identifying an individual; PHI is health data tied to an individual (regulated by HIPAA)
- ✓Cryptographic erasure destroys data by deleting the encryption key, rendering encrypted data irrecoverable without destroying the hardware
- ✓Degaussing destroys both the data and the magnetic media; it cannot be used on SSDs
1. An organization needs to retire a fleet of SSDs containing sensitive financial data. Which data sanitization method is most appropriate?
2. A security tool monitors all outbound email and blocks messages containing 16-digit numbers matching credit card patterns. Which technology is this?
3. An employee's name, date of birth, and home address are collected during a job application. What type of data is this?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.