Security Policies and Procedures · Topic 6 of 7
Protected Data in a Network
Identify protected data in a network, including PII, PSI, PHI and intellectual property, the rules that govern them, and the controls that protect them.
- 5 min
- PII identifies a person, alone or in combination with other data.
- PSI, usually read as personal security information, is data used to prove identity or protect access, such as passwords and keys.
- PHI is health data linked to a person, and HIPAA covers it in the United States.
What it is
Protected data is information that the law, a contract or the organisation itself says must be kept secure.
Losing it can bring fines, legal action and damage to trust. A security analyst must be able to recognise it in a log, a file or a network flow, because it decides how serious an incident is.
This page covers four types. They are personally identifiable information, PSI, protected health information and intellectual property. The outline does not spell out PSI, and study material usually reads it as personal security information.
How it works
Each type of data has a definition, examples and usual rules.
The four types
| Type | Meaning | Examples |
|---|---|---|
| PII, personally identifiable information | Data that identifies a specific person, alone or combined with other data | Name, address, date of birth, national ID number, phone number |
| PSI, usually read as personal security information | Data used to prove identity or to protect access | Passwords, PIN codes, security tokens, private keys, answers to security questions |
| PHI, protected health information | Health data linked to a person | Medical records, diagnoses, treatment and insurance details |
| Intellectual property | Creations of the organisation that have value | Source code, designs, formulas, trade secrets, patents, business plans |
PII needs care even when each piece looks harmless. A name together with a date of birth and an address can be enough for identity theft.
PSI is the data that gives access to other data. A stolen password or key can unlock far more than the item itself. It should be protected with strong storage, such as hashing for passwords, and not sent in clear text.
Sources differ on the name behind PSI, so judge a question by the description it gives.
PHI is health information tied to an individual. In the United States it is covered by HIPAA, a law that sets rules for health providers and their partners.
Intellectual property may not name any person, yet its loss can destroy a competitive advantage. It is protected by access control, agreements and monitoring for copying.
Another common category is payment card data, which is covered by the Payment Card Industry Data Security Standard. Many regions also have general privacy laws, such as the European GDPR.
Where protected data appears
- In databases and file shares
- In email and chat attachments
- On laptops, phones and removable media
- In backups
- In cloud storage and software as a service tools
- In logs, where it may leak by accident, such as a password in a URL
Spotting protected data on the network
An analyst can use several clues.
- Destination and protocol. Clear text protocols such as FTP, Telnet and HTTP expose the data to anyone on the path.
- Content patterns. A data loss prevention tool uses patterns, for example a long digit string in a card number format.
- Source system. Traffic from a database that holds records is more sensitive than traffic from a print server.
- Unusual volume. A bulk transfer from a sensitive server to an external address may be a breach.
Protecting it
| Control | How it helps |
|---|---|
| Encryption in transit and at rest | Makes stolen data unreadable |
| Access control and least privilege | Limits who can reach it |
| Data classification | Labels data so that handling rules are clear |
| Data loss prevention | Detects and blocks sensitive data leaving |
| Logging and monitoring | Shows who accessed what |
| Retention and disposal rules | Reduce the amount of data kept |
When protected data is exposed, the incident usually involves legal and compliance staff, since many laws require notice to the people affected or to a regulator within a set period.
What to remember for the exam
Seven facts cover most questions on this topic.
- PII identifies a person, alone or in combination with other data.
- PSI, usually read as personal security information, is data used to prove identity or protect access, such as passwords and keys.
- PHI is health data linked to a person, and HIPAA covers it in the United States.
- Intellectual property is valuable creative or business information, such as source code.
- Clear text protocols expose protected data to anyone on the path.
- Encryption, access control, classification and DLP protect protected data.
- An exposure of protected data usually involves legal and compliance staff.
Ask what the data is about. A person is PII, a login secret is PSI, a medical record is PHI, and a company secret is intellectual property.
Common mistakes
These four errors appear often.
Treating one data element as harmless. Several small items combined can identify a person.
Mixing up PII and PHI. PHI is the health information that is linked to a person.
Forgetting intellectual property. It has no personal details, but it may be the most valuable data.
Storing passwords in clear text. Passwords should be hashed.
Logs and error messages can leak protected data, so check what your systems write to them.
Check yourself
Work through these three questions.
What is the difference between PII and PHI?
PII is any data that identifies a person. PHI is health information that is linked to a person.
Which type of protected data includes passwords and private keys?
PSI, which this page reads as personal security information.
Why do clear text protocols matter for protected data?
Anyone who can see the traffic can read the data, so protected data should travel over encrypted links.
Topic 6 of 7 in Security Policies and Procedures
Test yourself on Security Policies and Procedures
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.