Page 321 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

columns holding sensitive data such as credit card data. Additionally,
they would implement strong authentication and authorization

controls to prevent unauthorized entities from accessing the database.

When the web application sends a request for data from the web
server, the database server verifies that the web application is
authorized to retrieve the data and, if so, the database server sends it.
However, this entails several steps. For example, the database
management system first retrieves and decrypts the data and formats

it in a way that the web application can read it. The database server
then uses a transport encryption algorithm to encrypt the data before
transmitting it. This ensures that the data in transit is secure.

The web application server receives the data in an encrypted format. It
decrypts the data and sends it to the web application. The web
application stores the data in temporary memory buffers while it uses
it to authorize the transaction. When the web application no longer

needs the data, it takes steps to purge memory buffers, ensuring that
all residual sensitive data is completely removed from memory.

The Identity Theft Resource Center (ITRC) routinely

tracks data breaches. They post reports through their website
(www.idtheftcenter.org/) that are free to anyone. In 2017, they
tracked more than 1,300 data breaches, exposing more than 174
million known records. Unfortunately, the number of records
exposed by many of these breaches is not known to the public. This
follows a consistent trend of more data breaches every year, and

most of these data breaches were caused by external attackers.

Handling Information and Assets

A key goal of managing sensitive data is to prevent data breaches. A
data breach is any event in which an unauthorized entity can view or
access sensitive data. If you pay attention to the news, you probably
hear about data breaches quite often. Big breaches such as the Equifax

breach of 2017 hit the mainstream news. Equifax reported that
attackers stole personal data, including Social Security numbers,