CISSP 5.3 - Data Protection Methods

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series adds extra tools to the Domain 2 data protection kit — the techniques organizations reach for when encryption and leak prevention alone are not enough, whether the goal is guarding creative work, keeping cloud use under control, or sharing data without exposing the people described inside it.

Frequently Asked Questions

What is digital rights management?

It is a set of controls that protect copyrighted work from theft and misuse, stopping unauthorized copying, changing, and sharing of things like books, music, and software. A license unlocks the product, always-on authentication makes it check in with a server before it will run, a continuous audit trail records every use, and an expiration date can cut off access when a subscription ends. Watermarks hidden inside a file will not stop a copy, but they can prove who leaked it.

How does a cloud access security broker guard the cloud?

It sits in the path between your users and your cloud services, inspecting everything that passes, so it can enforce whatever policy you set — for example, making sure every file is encrypted before it lands in storage. It can also handle authentication, log activity, and raise alerts on anything suspicious. Best of all, it drags shadow IT into the light, spotting the unapproved cloud apps that staff quietly signed up for.

What is the difference between pseudonymization and tokenization?

Both substitute a stand-in for sensitive data, and both can be reversed by someone holding the protected mapping. Pseudonymization swaps a real identifier for an alias, like a record referring to Subject 479 instead of a patient’s name, with the link kept in a separate protected store — it suits sharing a dataset with outsiders. Tokenization replaces sensitive data with a random token, as in tap-to-pay, where a secure vault held by a trusted party matches the token to the real card number.

What is anonymization, and why is it so tricky?

It strips out enough detail that no one can trace the data back to a person, and done right, the privacy rules simply stop applying because there is no individual left to protect. But true anonymity is hard, since clever inference can re-identify people from what seems like harmless leftover data. Randomized masking shuffles values within each column so rows no longer describe real people, and differential privacy adds a mathematical guarantee that no single person’s presence noticeably changes the result.

How do these privacy techniques really differ?

The dividing line is reversibility. Pseudonymization and tokenization are two-way doors, since a protected mapping lets an authorized party recover the original. Anonymization is a one-way door — once the data is truly scrambled, there is no key and no going back.

Reference: This article is based on concepts discussed in CISSP 5.3 - Data Protection Methods.