Sidebar
This is an old revision of the document!
Table of Contents
2.3.4.2.3 Data-In-Use
Overview
Data-in-Use covers data being processed (i.e., updated, processed, erased, accessed or read) by a system. Data-In-Use is not passively stored, but is actively moving through parts of a Computing Platform. Data-In-Use is one of three states of digital data – the other states are Data-at-Rest and Data-in-Motion.
Data states are used by information security professionals to identify Endpoints where data should be encrypted. In addition to encryption, some important ways that Data-In-Use is protected include user authentication at all stages, strong identity management and well-maintained permissions for profiles within an organization.
Examples of Data-In-Use include data stored or processed in Random Access Memory (RAM), Datastores or CPUs. Requesting access to transaction history on a banking website or authorizing user login input are applications of Data-In-Use.
Runtime Issues for Data-In-Use
Many problems occurring during *Data-In-Use are traceable to Runtime Errors. * Logic Error * Memory Leak * Division by Zero Error * Undefined Object Error * Input/Output Device Error * Encoding Error * Overflow * Underflow * Wrap Around * Range Error * 2.3.4.7 Data Memory Taxonomy * Heap Error ==== Security of Data-In-Use ==== Due to Data-In-Use being directly accessible by one or more users, data in this state is vulnerable to attacks and exploits. Additionally, security risks become greater as the permissions and devices increase. Oftentimes, Data-In-Use can contain digital certificates, Encryption keys, and Intellectual Property (IP) which make it crucial for businesses to monitor. Common practices for protecting Data-In-Use are defined under Securability and include: ^ Physical Security |
Physical Security is essential while data is being processed. Often, the Cipher Data is decrypted to Plaintext during processing. The decrypted data can leave residues behind in on-line and off-line storage, as well as in memory after the processing is complete. Therefore, when it is not possible to guarantee physical security, steps be taken to prevent:
| ^ Data Security |
Data Security is the process of protecting data from unauthorized access and data corruption by using a Encryption Algorithm to encrypt data throughout its lifecycle especially while the data is in use. Encryption can be any combination of Hashing, tokenization, and Key Management practices that protect data across all Applications and Platforms.
With the rise of Decentralized and Distribute systems, it is no longer possible to trust all the parts of a Software Stack and Solution Stack especially devices such as: Network Device, Mobile Device, Peripheral Device, or Storage Device, Web Service. Also, each Web Service also represent a stack of more components, such as: Apache CloudStack, LAMP (Linux, Apache, MySQL, PHP/Perl/Python) , Oracle Cloud Stack , Web Service Protocol Stack. Each of these components, the connections and the Network devices represent a risk, especially when Instrumentation for monitoring of the component is added to the mix. For example, using a Debugger tool is useful during development for observing the state of the component, but those features leave vulnerabilities for exposing sensitive information. See MITRE Common Weakness Enumeration (CWE) list.
The following are approaches to helping solve some of these problems:
- CWE-215: Insertion of Sensitive Information into Debugging Code - The application inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
- CWE-489: Active Debug Code - The application is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
- CWE-1295: Debug Messages Revealing Unnecessary Information - The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
| ^ Network Security |
Network Security covers all Network Device and is an over-arching term describing the policies and procedures implemented by a network administrator to avoid and keep track of unauthorized access, exploitation, modification, or denial of the network and network resources.
This means that a well-implemented network security blocks viruses, Malicious Software (Malware), hackers, etc. from accessing or altering secure information. Many of these goals can be achieved by having:
| ^ Platform Security |
Platform Security is the security architecture covering Hardware (H/W), and Software (SW) for the entire Computing Platform Stack, including: Hardware Platform, Operating System Platform, Runtime Platform, and Network Platform.
Many of these goals can be achieved by considering:
- Authorization of Peripheral Device such as:
- Geolocation services
- Transmission Control Protocol (TCP) networks
| ^ Application Security |
Application Security is the Business Process of developing, adding, and testing security features within applications to prevent security Vulnerabilities against cyberthreats such as unauthorized access and modification.
Application Security describes security measures in the Application that aim to prevent data or code within the Application from being stolen or hijacked. It encompasses the security considerations that happen during application development and design, but it also involves systems and approaches to protect Applications after deployment.
Application Security covers Hardware (H/W), Software (SW), and Business Processes to minimize security Vulnerabilities. Application Security also covers any security measures added-to or integrated-into the Appication. For example, the use of a Software Firewall.
- Note: The use of the word Application here should not beconfused with OSI Application Layer or the TCP/IP Conceptual Model Application Level.
- CWE-215: Insertion of Sensitive Information into Debugging Code - The application inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
- CWE-489: Active Debug Code - The application is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
- CWE-1295: Debug Messages Revealing Unnecessary Information - The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
| ^ Securty Culture |
CyberSecurity Culture (CSC) CyberSecurity Culture (CSC) of organizations refers to the knowledge, beliefs, perceptions, attitudes, assumptions, norms and values of people regarding Cybersecurity and how these manifest in people’s behavior with information technologies. CyberSecurity Culture (CSC) is about making information security considerations an integral part of an employee’s job, habits and conduct, embedding them in their day-to-day actions.
Some common tools to help create a good Securty Culture are:
| ^ Data Logging |
Data Logging (also known as Logging) is the process of creating a Log which is the automatically production of time-stamped documentation for events relevant to a particular system. There are many tools available to help with Logging, some are Technical Standards and some are de facto Standards:
- Technical Standardsde facto StandardsTools:
| ^ Access Control |
Access Control defines a set of controls restricting access to resources based on the group membership, identity, clearance, physical & logical location and need-to-know. In other words, it provides the Authorization for access to resources. Additionally, access includes method of permission to consume, enter, control, restrict, use and protect the resource to guarantee: Availability, Confidentiality, and Integrity.
Some of the more traditional resources requiring Access Control are: Memory and Storage, Peripheral Device, Central Processing Unit (CPU), Heap Memory, Stack Memory, Non-Volatile Storage (NVS), and Network Interface Card (NIC).
Many of these goals can be achieved by considering:
| ^ Inentification and Authetication |
Identification, Authentication for the basis for access to the system. Recently, a new Data State has been added called Data-in-Use. In many ways, it is harder to to use Identification and Authtetication than with 2.3.4.2.1 Data-at-Rest , or data_at_motion becase processing the Data generally requires processing a Cryptographic Algorithm to decrypt the Data. The use of Protection Rings can help, but at each level there is still a need to identify and authentic the request.
The following are some of the ways to establish the Identity of an entity and to Authenticate the entity making the request.
| ~~DISCUSSION:on|Outstanding Issues~~ ~~DISCUSSION:off~~
dido/public/ra/1.2_views/3_taxonomic/4_data_tax/02_state_taxonomy/processing.1642881071.txt.gz · Last modified: 2022/01/22 14:51 by nickTranslations of this page:
