Hey, so in this video,
we are going to talk about "Understanding Data Protection".
We're going to look at a couple of important concepts,
the first being defense in depth.
We'll talk about this important security concept
and what it means for you.
And then we'll talk about encrypting data
at rest and in motion,
and what you need to know for the DP-203.
So with that, let's go ahead and get started.
So to start our discussion on defense in depth,
we are first going to go inside the CIA.
And we're going to talk about the 3 letters, C-I-A,
first being confidentiality.
So when we talk about security, it is very important
that the data is kept secret or private.
So in order to do this, we prevent the unauthorized sharing
of data, whether that's by accident or on purpose.
So that's a very important concept
as we think about building our security system.
So it's the theory of least privilege,
is what you'll hear that as.
Next, integrity.
When we think about integrity, we want to make sure
that our data is trustworthy and free from tampering.
We want to make sure that nothing else
is going to go in there
and mask itself or pretend to be what we're trying to go to.
So when you think of this,
think about those websites that are spoof websites
to grab your information.
This falls into the integrity level of CIA.
And so, in order to combat this,
you can do things like hashing, or you can do encryption,
or digital certificates, or things like that.
And then the final concept is availability.
So this is making sure that our data is available.
So we are looking at Denial of Service attacks
and ransomware.
And how do we protect ourselves
against those kinds of threats?
So continuing on,
let's talk about some of the security layers
that you would typically encounter.
We're going to start over here with this picture on the
right of our gold, or our golden goose, which is our data.
We always start there,
because we want to build everything around that data.
And so you'll see different rings
that you would typically build in.
The first being something like a physical security.
And I'll tell you that the layers that I'll show,
if you dive into the industry,
there's a little bit of differences
in the layers that they show, but the concept still remains.
So just keep that in mind,
that the idea is that we're building layers of security
around protecting our data.
It's not just 1 layer.
And if you break through that, then you have everything.
Instead, there's multiple pieces.
So physical security.
We would look at things like our building
and our computing hardware.
And we have identity and access, which is our second layer.
And so this is thinking of single sign-on,
multifactor authentication.
So basically, controlling the access
and making sure that you know who the person is
and why they should be there.
Then you look at your perimeter,
and your perimeter is your firewalls.
And so this is going to help with that protection
on malicious attacks against your network.
And it's going to help against that Denial
of Service attacks and several other things as well.
Then, we start to build our network connectivity.
So we start to look at limiting communication
between those resources.
So building silos, again, so if you break through,
you don't have access to everything,
but just that 1 little piece that you broke into.
So networking is a critical component that is,
by definition, denied by default, usually.
So you don't have access to it
unless you've been granted access.
And then you dive in a little further
and you look at things like your compute.
And when you look at compute, that's your VMs
and your other compute resources that helps to drive
everything that you're going to do in the cloud.
And then you have your applications.
So with our applications, we want to make sure that they're,
of course, patched,
and they're secure and free of vulnerabilities.
And then finally, our last, seventh, layer is,
like I said before, that's your data.
So, do we have it stored in a database?
Is it masked appropriately?
So as you think about security, you don't want to just think
about 1 component, but you want to think about
these concepts that we discuss and where it fits
into this layered security approach, or defense in depth.
And then finally, let's talk a little bit
about data encryption, so data at rest.
So when you talk about data at rest,
this is just literally data that's being stored somewhere,
likely in Blob Storage or something of that nature.
And what I'll tell you is data at rest
is generally on by default.
So it uses things like encryption keys
in order to secure that data while it's at rest.
And in Azure, at this point,
most everything is on by default for data at rest.
Again, you'll want to check services,
but from a DP-203 perspective,
I would expect this to be the typical answer,
because for instance, like with Blob Storage,
anything stored after 2017 was automatically data encryption
by default when at rest.
So when we look at data in motion, that's the other side.
So when we move data between services.
So that is going to use something like our TLS,
or Transport Layer Security.
Most services, again, have this on by default.
And for the TLS version, 1.2 or later is recommended.
So again, the takeaway from data at rest and in motion
is, for most services in the data architect's life,
this is going to be on by default.
You definitely want to check before you start, but again,
you would assume that, for the DP-203,
that you probably don't have to do anything
to get those turned on.
So let's go ahead and start to wrap all of this up.
The first thing to remember is defense in depth.
When we think about defense in depth,
we talk a lot about scenarios.
This is the perfect thing to focus on.
So as you go through this section,
think about the different concepts,
and what layer of security each of those concepts
would fit into.
So the defense in depth, the other piece to this,
is it allows for flexibility and stronger security.
The idea is the "bend but don't break".
So if you break through 1 piece of security
or 1 layer of security, that doesn't give you access
to the entire network.
There's multiple layers protecting the data.
And then the next piece is data encryption in motion.
Hey, it's usually turned on, and if you are doing in motion,
you want a TLS of 1.2 or better.
Same thing's true for data at rest.
It's generally turned on,
so not something that you need to focus on,
but something that you need to be aware of,
at least that it exists.
So with that, we're done with our
starting defense in depth discussion,
and ready to move on to the next topic.