In protecting data it's crucial to set up goals that you want to achieve.
Our first objective should be the confidentiality of data
confidentiality means that data is safeguarded against unauthorized access
information should be categorized according to its sensitivity.
It doesn't make sense to take measures for protecting information that's published online on a company's
website
and the company will understandably be happy that there are visitors on the Web site
internal information is the second class of information
this category of data is available to a broad group of selected people.
For example for all the employees in the company
we wouldn't want unauthorized persons to access this type of information.
But it doesn't spell the end of the world if a breach occurs.
The next category of information includes personal information
personally identifiable information is defined as information that can be used to easily and specifically
identify a person to whom the information relates national identification numbers like Social Security
numbers are an obvious example of personal information.
There's also sensitive data this class of data.
If disclosed to the public brings direct losses to a specific person
the last day the confidentiality category includes classified information.
This is a type of data that should only be accessed by trusted people disclosing classified information
deals a grievous blow to a company
assigning a level of sensitivity to data stored on a system vast tracts the implementation of a data
security policy in a company.
If a company fails to introduce this policy this could end in this sort of situations you've seen in
previous modules where you can view classified sensitive and confidential information on the Internet
next to people's personal information.
Confidentiality of data has to be protected in some way.
In the past obtaining or extracting confidential data was a difficult feat.
The next time you see a person go through the garbage bins of your company remember that the person
does not have to be a beggar in search of food.
In the U.S. the trash that's located in a company's site belongs to that company trespassing and stealing
things from trash bins is illegal.
The contents of the bins only later become public property.
It's increasingly easy to find confidential information on the Internet.
Let's see how this can be done.
To do this we'll use a hacking technique that most of you know very well.
Google Hacking will see if Google can be used to find some information on people who interest us.
We'll also find out if it's true that once a piece of information is put on the web it will exists there
forever.
Finally we'll also use specialist programs like Foka to automate the process of finding information.
Let's start with a question.
Is it possible to completely erase a piece of information that has been published online.
To find an answer we'll use a site called archive dot org.
There's a time machine called the wayback machine available on the site.
Let's type in any address you're interested in.
For example Microsoft dot com and click on take me back
after the search ends.
You'll be able to view the archived versions of the page.
Let's start with 1996.
There are only a few copies of the page from that year.
Let's see how the Web site looked on October 29th 1996.
We have a chance to take a peek into the past and see how the page looked in 1996
all things on the page are related to one another and are still active.
You can read press information about Microsoft from 1996
what's been put on the Internet stays on the Internet forever.