PROTECT: Data Security (PR.DS)

Learning Objectives

By the end of this lesson, you will be able to:

• Implement data classification schemes that guide protection decisions
• Deploy encryption strategies for data at rest, in transit, and in use
• Create comprehensive data lifecycle management processes
• Build data loss prevention (DLP) capabilities appropriate for startup resources
• Manage data security across cloud, on-premises, and hybrid environments

Introduction: Data Is Your Crown Jewel

For most startups, data is the most valuable asset. Whether it’s your proprietary algorithms, customer information, financial records, or intellectual property, data drives your business value. Lose it, and you might lose everything—customer trust, competitive advantage, regulatory compliance, and ultimately, your business.

Yet most startups treat data security as an afterthought. Data sprawls across laptops, cloud services, and SaaS applications with little oversight. Employees share sensitive information through insecure channels. Backups are sporadic and untested. Encryption is applied inconsistently, if at all.

This lesson shows you how to implement comprehensive data security that protects your information throughout its lifecycle—from creation to destruction—without creating friction that slows down your business.

Understanding PR.DS: Data Security

NIST CSF 2.0 PR.DS Outcomes

PR.DS-01: Data-at-rest is protected

PR.DS-02: Data-in-transit is protected

PR.DS-03: Assets are formally managed throughout removal, transfers, and disposition

PR.DS-04: Adequate capacity to ensure availability is maintained

PR.DS-05: Protections against data leaks are implemented

PR.DS-06: Integrity checking mechanisms are used to verify software, firmware, and information integrity

PR.DS-07: The development and testing environment(s) are separate from the production environment

PR.DS-08: Integrity checking mechanisms are used to verify hardware integrity

Data Security Principles for Startups

Data Minimization:

• Collect only data you actually need
• Retain data only as long as necessary
• Delete data when no longer required
• Reduce your attack surface by having less to protect

Defense in Depth:

• Multiple layers of protection for critical data
• Assume any single control might fail
• Combine preventive, detective, and responsive controls
• Balance security with usability and cost

Privacy by Design:

• Build data protection into systems from the start
• Consider privacy implications in all decisions
• Implement data subject rights and controls
• Prepare for privacy regulations before they apply

Data Classification and Inventory

Data Classification Framework

Classification Levels:

Restricted (Highest Protection)

• Examples: Customer payment information, employee SSNs, health records, cryptographic keys
• Impact if Compromised: Severe financial, legal, and reputational damage
• Protection Requirements: Encryption everywhere, strict access controls, audit logging
• Handling: Need-to-know only, secure transmission, secure disposal

Confidential

• Examples: Customer PII, financial records, strategic plans, source code
• Impact if Compromised: Significant business and competitive harm
• Protection Requirements: Encryption at rest and transit, access controls, monitoring
• Handling: Internal use only, controlled sharing, retention limits

Internal

• Examples: Employee directories, internal policies, project documentation
• Impact if Compromised: Limited business impact, minor competitive disadvantage
• Protection Requirements: Basic access controls, secure transmission
• Handling: Internal distribution, standard security controls

Public

• Examples: Marketing materials, public documentation, press releases
• Impact if Compromised: No significant impact
• Protection Requirements: Integrity protection, availability assurance
• Handling: Unrestricted distribution, focus on accuracy

Data Discovery and Inventory

Automated Discovery Methods:

• Cloud Access Security Brokers (CASB) for SaaS data
• Data Loss Prevention (DLP) tools for scanning
• Cloud provider native tools (Macie, Cloud DLP)
• Database discovery and classification tools

Manual Discovery Process:

## Data Discovery Checklist

### Business Data Sources
- [ ] Customer databases and CRMs
- [ ] Financial systems and records
- [ ] HR systems and employee data
- [ ] Email and communication systems
- [ ] File shares and cloud storage

### Technical Data Sources
- [ ] Source code repositories
- [ ] Configuration files and secrets
- [ ] Backup systems and archives
- [ ] Log files and analytics data
- [ ] Development and test data

### Shadow IT Discovery
- [ ] Department spreadsheets and databases
- [ ] Personal cloud storage usage
- [ ] Unofficial collaboration tools
- [ ] Mobile apps with data access
- [ ] Browser-based data storage

Data Inventory Template:

## Data Inventory Register

| Data Type | Classification | Location | Owner | Retention | Encryption | Access Controls | Last Review |
|-----------|---------------|----------|-------|-----------|------------|-----------------|-------------|
| Customer PII | Confidential | PostgreSQL DB | Product Team | 7 years | AES-256 at rest | RBAC, MFA | 2024-01-15 |
| Payment Data | Restricted | Stripe (3rd party) | Finance | N/A (external) | Provider managed | API keys, audit logs | 2024-01-10 |
| Source Code | Confidential | GitHub | Engineering | Indefinite | TLS transit | SSO, 2FA | 2024-01-20 |
| Employee Records | Confidential | BambooHR | HR | 7 years post-term | Provider managed | RBAC, SSO | 2024-01-05 |

Encryption Strategies

Encryption at Rest

Storage Encryption Options:

Full Disk Encryption:

• Windows: BitLocker (built-in, free)
• macOS: FileVault (built-in, free)
• Linux: LUKS (built-in, free)
• Mobile: Default on modern iOS/Android

Database Encryption:

• Transparent Data Encryption (TDE): Entire database encrypted
• Column-Level Encryption: Specific sensitive fields encrypted
• Application-Level Encryption: Data encrypted before database storage
• Tokenization: Sensitive data replaced with tokens

Cloud Storage Encryption:

## Cloud Encryption Configuration

### AWS S3
- Default encryption with SSE-S3 (AES-256)
- Customer managed keys with SSE-KMS
- Client-side encryption for maximum control
- Bucket policies enforcing encryption

### Google Cloud Storage
- Default encryption at rest (AES-256)
- Customer-managed encryption keys (CMEK)
- Client-side encryption options
- Encryption audit logging

### Microsoft Azure
- Storage Service Encryption (SSE)
- Azure Key Vault integration
- Bring your own key (BYOK)
- Double encryption options

Encryption in Transit

Network Encryption:

• HTTPS/TLS 1.3: All web traffic and APIs
• VPN: Remote access and site-to-site connections
• SSH/SFTP: Secure administrative access and file transfers
• Email: TLS for SMTP, S/MIME or PGP for sensitive messages

Certificate Management:

## TLS Certificate Best Practices

### Certificate Requirements
- Use trusted Certificate Authorities (CA)
- Implement certificate pinning for mobile apps
- Automate certificate renewal (Let's Encrypt, ACME)
- Monitor certificate expiration

### Configuration Standards
- TLS 1.2 minimum, prefer TLS 1.3
- Strong cipher suites only
- Perfect Forward Secrecy (PFS)
- HSTS headers with preloading

### Common Mistakes to Avoid
- Self-signed certificates in production
- Weak cipher suites for compatibility
- Expired certificates causing outages
- Missing intermediate certificates

Encryption Key Management

Key Management Hierarchy:

graph TD
    A[Master Key - Hardware Security Module] --> B[Key Encryption Keys - Cloud KMS]
    B --> C[Data Encryption Keys - Application Level]
    C --> D[Encrypted Data]

Startup-Friendly Key Management:

Level 1: Basic (Built-in Solutions)

• Operating system key stores
• Cloud provider managed keys
• Password manager for secrets
• Git-crypt for code repositories

Level 2: Intermediate (Cloud KMS)

• AWS KMS, Google Cloud KMS, Azure Key Vault
• Centralized key management
• Audit logging and access controls
• ~$1 per key per month

Level 3: Advanced (Dedicated Solutions)

• HashiCorp Vault (open source)
• Hardware Security Modules (HSM)
• Dedicated key management services
• $100-1000+ per month

Key Rotation Strategy:

• Encryption keys: Rotate annually or on compromise
• Signing keys: Rotate every 2-3 years
• API keys: Rotate quarterly or on personnel changes
• Passwords/secrets: Rotate on suspicious activity

Data Lifecycle Management

Data Creation and Collection

Data Minimization Principles:

• Collect only what you need for specific purposes
• Avoid “collect now, figure out use later”
• Document purpose and legal basis for collection
• Implement privacy-preserving techniques

Secure Data Entry:

## Secure Data Collection Checklist

### Web Forms
- [ ] HTTPS only, no HTTP collection
- [ ] Input validation (client and server-side)
- [ ] CSRF protection
- [ ] Rate limiting
- [ ] CAPTCHA for public forms

### API Data Collection
- [ ] Authentication required
- [ ] Authorization checks
- [ ] Input validation and sanitization
- [ ] Rate limiting and throttling
- [ ] Audit logging

### File Uploads
- [ ] File type validation
- [ ] Size limits enforced
- [ ] Malware scanning
- [ ] Separate storage location
- [ ] Access controls

Data Storage and Processing

Secure Storage Architecture:

• Segregation: Separate production from non-production data
• Redundancy: Multiple copies with geographic distribution
• Access Controls: Role-based access with MFA
• Monitoring: Access logging and anomaly detection
• Backup: Regular automated backups with encryption

Data Processing Security:

• Process minimum necessary data
• Use secure coding practices
• Implement input/output validation
• Maintain audit trails
• Segregate processing environments

Data Sharing and Transmission

Internal Data Sharing:

## Internal Data Sharing Guidelines

### Approved Methods (by Classification)
**Restricted Data:**
- Encrypted email with verified recipients
- Secure file transfer systems
- Dedicated secure collaboration platforms

**Confidential Data:**
- Company email (with encryption for external)
- Approved cloud storage with access controls
- Internal collaboration tools

**Internal Data:**
- Standard company communication tools
- Shared drives with appropriate permissions

### Prohibited Methods (All Classifications)
- Personal email accounts
- Consumer file sharing (Dropbox personal, etc.)
- Unencrypted removable media
- Public cloud storage

External Data Sharing:

• Data Processing Agreements (DPA) with vendors
• Encryption requirements for data transfer
• Secure file transfer protocols (SFTP, AS2)
• API security with authentication and rate limiting
• Regular third-party security assessments

Data Retention and Disposal

Retention Schedule Template:

## Data Retention Schedule

| Data Type | Retention Period | Legal Basis | Disposal Method |
|-----------|-----------------|-------------|-----------------|
| Customer PII | 7 years after last activity | Tax law | Secure deletion |
| Payment Records | 7 years | PCI DSS | Secure deletion |
| Employee Records | 7 years post-employment | Labor law | Secure deletion |
| Email | 3 years | Business need | Automated purge |
| Logs | 1 year | Security/compliance | Automated rotation |
| Backups | 90 days | Recovery need | Automated expiration |

Secure Disposal Methods:

• Digital Media: Cryptographic erasure, multi-pass overwriting
• Physical Media: Physical destruction, degaussing
• Cloud Data: Verified deletion including backups
• Paper Documents: Cross-cut shredding, secure disposal service

Data Loss Prevention (DLP)

DLP Strategy for Startups

Startup DLP Maturity Model:

Level 1: Basic Controls

• Email attachment restrictions
• Cloud storage permissions
• USB device blocking
• Basic egress filtering

Level 2: Policy-Based DLP

• Content inspection rules
• Pattern matching (SSN, credit cards)
• User activity monitoring
• Automated policy enforcement

Level 3: Advanced DLP

• Machine learning detection
• User behavior analytics
• Data lineage tracking
• Integrated incident response

Technical DLP Implementation

Email DLP:

## Email DLP Configuration

### Gmail/Google Workspace
- Predefined content detectors (SSN, credit cards)
- Custom regex patterns for company data
- Outbound email scanning
- Attachment scanning and blocking
- Admin quarantine for review

### Microsoft 365
- Sensitive information types
- DLP policies and rules
- Policy tips for users
- Incident reports and alerts
- Integration with Cloud App Security

Endpoint DLP:

• Monitor and control data movement
• Block unauthorized USB devices
• Screen capture prevention
• Clipboard monitoring
• Print control for sensitive documents

Cloud DLP:

• CASB integration for SaaS applications
• Cloud storage scanning and classification
• Shadow IT discovery and control
• API-based data protection
• Real-time and retrospective scanning

DLP Policy Examples

## Sample DLP Policies

### Policy 1: Credit Card Protection
**Condition:** Content contains credit card numbers
**Action:** Block external sharing, notify security team
**Exception:** Approved payment processing systems

### Policy 2: Source Code Protection
**Condition:** Files with .py, .js, .java extensions
**Action:** Warn user, log activity, block personal email
**Exception:** Open source projects, public repositories

### Policy 3: Customer Data Protection
**Condition:** Files containing >10 email addresses
**Action:** Require encryption, manager approval for external sharing
**Exception:** Marketing approved campaigns

### Policy 4: Intellectual Property
**Condition:** Documents marked "Confidential" or "Proprietary"
**Action:** Block public sharing, watermark, audit trail
**Exception:** Legal and executive approved sharing

Maintaining Data Integrity

Integrity Verification Methods

File Integrity Monitoring:

• Track changes to critical files and configurations
• Detect unauthorized modifications
• Alert on integrity violations
• Maintain audit trail of changes

Code and Artifact Signing:

## Code Signing Implementation

### Development Artifacts
- Sign all production releases
- Verify signatures before deployment
- Maintain signing key security
- Document signing process

### Infrastructure as Code
- Sign Terraform/CloudFormation templates
- Verify before infrastructure changes
- Version control with integrity checks
- Automated validation in CI/CD

### Container Images
- Sign Docker images with Notary/Cosign
- Verify signatures in admission controllers
- Scan for vulnerabilities before signing
- Maintain chain of trust

Backup and Recovery

3-2-1 Backup Rule:

• 3 copies of important data
• 2 different storage media types
• 1 offsite/offline copy

Backup Strategy Template:

## Backup Strategy

### Critical Data (RPO: 1 hour, RTO: 4 hours)
- Continuous replication to secondary region
- Hourly snapshots with 7-day retention
- Daily backups to cold storage
- Quarterly offline backup

### Important Data (RPO: 4 hours, RTO: 24 hours)
- 4-hour snapshots
- Daily backups with 30-day retention
- Weekly cold storage backup
- Monthly offline backup

### Standard Data (RPO: 24 hours, RTO: 72 hours)
- Daily backups
- 14-day retention
- Weekly cold storage

### Testing Schedule
- Monthly: Restore individual files
- Quarterly: Full system restore test
- Annually: Complete disaster recovery exercise

Environment Segregation

Development vs. Production Separation

Environment Architecture:

## Environment Segregation Model

### Production Environment
- Customer data and live systems
- Restricted access (operations team only)
- Change control and approval required
- Full monitoring and alerting
- Regular backups and DR

### Staging Environment
- Production-like configuration
- Synthetic or anonymized data
- Limited access (dev + ops teams)
- Pre-production testing
- Performance validation

### Development Environment
- Developer access
- Sample/synthetic data only
- Rapid iteration allowed
- Limited monitoring
- No customer data

### Local Development
- Developer machines
- Mock data only
- Docker/containers for consistency
- No production credentials
- Security scanning required

Data Sanitization for Non-Production:

• Remove or mask PII
• Generate synthetic test data
• Use data subsetting for size reduction
• Maintain referential integrity
• Document sanitization process

Hands-On Exercise: Design Your Data Security Strategy

Step 1: Data Classification

Identify Your Data Types:

1. _________________ (Classification: _________)
2. _________________ (Classification: _________)
3. _________________ (Classification: _________)
4. _________________ (Classification: _________)
5. _________________ (Classification: _________)

Define Protection Requirements:

Step 2: Encryption Planning

Encryption Implementation:

• Full disk encryption on all devices
• Database encryption for sensitive data
• TLS for all web traffic
• Email encryption for sensitive comms
• Backup encryption

Key Management Approach:

• Key storage solution: _____________
• Key rotation frequency: _____________
• Recovery procedures: _____________

Step 3: DLP Strategy

DLP Priorities:

1. Protect: _________________ (Method: _________)
2. Protect: _________________ (Method: _________)
3. Protect: _________________ (Method: _________)

DLP Implementation Timeline:

• Month 1: _________________
• Month 3: _________________
• Month 6: _________________

Step 4: Backup and Recovery

Backup Requirements:

• Critical data RPO: _____ hours
• Critical data RTO: _____ hours
• Backup frequency: _____________
• Retention period: _____________
• Testing frequency: _____________

Real-World Example: HealthTech Startup Data Security

Company: 38-employee telemedicine platform Challenge: HIPAA compliance, patient data protection, rapid scaling

Initial State:

• Inconsistent encryption implementation
• No data classification scheme
• Manual backup processes
• Development using production data

Phase 1: Foundation (Months 1-3)

Actions:

• Implemented data classification (PHI, PII, Internal, Public)
• Deployed full disk encryption on all devices
• Enabled database encryption for patient records
• Created data inventory and mapping

Results:

• 100% device encryption compliance
• All PHI encrypted at rest and transit
• Complete data inventory established
• HIPAA risk assessment passed

Phase 2: Controls (Months 4-9)

Implementations:

• Google Workspace DLP for email/drive
• Automated backup with encryption
• Environment segregation (dev/staging/prod)
• Data retention and disposal procedures

Achievements:

• Zero PHI in development environments
• 1-hour RPO, 4-hour RTO achieved
• DLP blocking 50+ risky shares monthly
• Compliant data retention process

Phase 3: Maturity (Months 10-18)

Advanced Capabilities:

• Cloud Access Security Broker (CASB)
• Database activity monitoring
• File integrity monitoring
• Automated data discovery and classification

Business Impact:

• Zero data breaches or HIPAA violations
• Passed 12 customer security assessments
• 60% reduction in data security incidents
• Achieved HITRUST certification
• Enabled expansion to 5 new states

Investment and ROI:

• Total investment: $125,000
• Avoided penalties: $500,000+ (HIPAA fines)
• Business enabled: $2M in new contracts
• ROI: 1,700% in 18 months

Key Success Factors:

• Started with classification to prioritize efforts
• Focused on high-risk data first (PHI)
• Automated wherever possible
• Regular testing and validation
• Clear policies and training

Common Data Security Challenges

Challenge: “We Don’t Know Where All Our Data Is”

Solution:

• Start with critical data types (customer, financial)
• Use automated discovery tools
• Interview department heads
• Review SaaS application inventory
• Create ongoing discovery process

Challenge: “Encryption Slows Everything Down”

Solution:

• Use hardware acceleration where available
• Implement selective encryption for sensitive data
• Optimize database queries for encrypted data
• Use caching strategies
• Balance security with performance needs

Challenge: “Developers Need Production Data”

Solution:

• Create realistic synthetic data
• Implement data masking/sanitization
• Use subsetting for smaller datasets
• Provide secure access when absolutely necessary
• Monitor and audit production data access

Challenge: “DLP Creates Too Many False Positives”

Solution:

• Start with simple, high-confidence rules
• Tune policies based on actual data
• Use warning mode before blocking
• Involve users in policy refinement
• Focus on critical data types first

Key Takeaways

1. Classification Drives Protection: Know what data you have and its value before protecting it
2. Encryption is Non-Negotiable: All sensitive data must be encrypted at rest and in transit
3. Lifecycle Management Essential: Data security spans from creation to destruction
4. Automation Enables Scale: Manual data security processes don’t scale with growth
5. Test Recovery Regularly: Backups are worthless if you can’t restore them

Knowledge Check

1. What’s the most important first step in data security?

   • A) Implementing encryption everywhere
   • B) Data discovery and classification
   • C) Buying DLP tools
   • D) Creating backup procedures

2. Which encryption approach is best for startups?

   • A) Encrypt everything always
   • B) Never encrypt to maintain speed
   • C) Risk-based encryption for classified data
   • D) Only encrypt customer data

3. How often should backup restoration be tested?

   • A) Never - trust the process
   • B) Annually
   • C) Monthly for critical systems
   • D) Only after incidents

Additional Resources

• Data classification templates and tools (coming soon)
• Encryption implementation guides (coming soon)
• DLP policy examples and tuning guides (coming soon)

In the next lesson, we’ll explore how to establish information protection processes and procedures that maintain security throughout your technology lifecycle.