2.1.7. Sensitive Data Protection
💡 First Principle: You cannot protect data you haven't classified — DLP and other data protection controls only work when you know what data is sensitive, where it lives, and what "normal" access to it looks like.
Data protection is a three-step problem: classify (identify what's sensitive), locate (find where it lives), and control (enforce appropriate access, transmission, and storage policies). Most organizations struggle at step two — sensitive data tends to spread to unexpected locations (user desktops, test environments, email attachments) because convenience trumps process.
DLP (Data Loss Prevention) monitors and controls data in three states:
- Data in motion (network DLP): inspects traffic leaving the network for sensitive patterns — credit card numbers, SSNs, classified document markers
- Data at rest (storage DLP): scans repositories (file shares, cloud storage, endpoints) for sensitive data stored inappropriately
- Data in use (endpoint DLP): controls what users can do with sensitive data — printing, copying to USB, pasting into email
PII (Personally Identifiable Information) is any data that can identify an individual — name, SSN, email, phone, IP address, biometrics. Regulatory frameworks (GDPR, CCPA) impose strict requirements on how PII is collected, stored, and protected.
Cardholder Data (CHD) is the specific category of PII covered by PCI DSS — the primary account number (PAN), cardholder name, expiration date, and service code. PCI DSS mandates that CHD be encrypted at rest, transmission must use strong cryptography, and the cardholder data environment (CDE) must be isolated from other networks.
⚠️ Exam Trap: DLP cannot prevent all data exfiltration. It matches patterns you've defined — an attacker who screenshots sensitive data, uses steganography, or exfiltrates via an unmonitored channel can bypass DLP. It's one layer of a defense-in-depth approach, not a complete solution.
Reflection Question: A DLP system is configured to block outbound emails containing 16-digit credit card numbers. An attacker sends an email with the card number formatted as 4111-1111-1111-1111 (with dashes) instead of 4111111111111111. Has the DLP been bypassed? What does this reveal about DLP configuration requirements?
