Lesson 10 — 25 Decision Rules + Chapter Readiness Gate
High-value decision rules
- Security requirement vs control — why protection is needed vs mechanism that enforces it.
- Privacy/confidentiality need vs legitimate access — protect sensitive interests vs enable required business use.
- Vulnerability vs Threat vs Risk — weakness vs possible adverse action/event vs evaluated business loss.
- Risk classification vs Confidentiality classification — risk/sensitivity prioritization vs internal access/handling level.
- Data Steward vs Information Security — business classification/use vs technical enforcement/operations.
- Authentication vs Authorization — prove identity vs grant privileges.
- Authorization vs Entitlement — permission decision vs total effective data/capability exposure.
- Access vs Audit — actual use vs independent evidence-based evaluation.
- Monitoring vs Audit — operational observation/detection vs independent assurance.
- Confidentiality vs Regulation — internal highest sensitivity level vs additive external obligations.
- Hashing vs Encryption — integrity/verification representation vs protection of readable content using keys.
- Private-key vs Public-key — same shared secret vs paired public/private keys.
- Persistent vs Dynamic masking — stored copy permanently changed vs displayed result changed while source stays intact.
- In-flight vs In-place masking — transform during movement vs overwrite in current location.
- Excessive privilege vs Legitimate-privilege abuse — too much granted vs valid access used improperly.
- Privilege elevation vs Service-account abuse — gain higher rights through exploit vs powerful process identity used improperly.
- Shared account vs Service account — generic human identity vs controlled non-human process identity.
- Policy vs Standard vs Control/Procedure — intent vs measurable rule vs enforcement/workflow.
- Role assignment grid vs Role hierarchy — data-first access mapping vs people/workgroup inheritance.
- CRUD/CRUDE vs RACI — permitted data operations vs accountability relationships.
- Firewall vs Data-centric access — traffic-path filtering vs row/column/view/entitlement control.
- Backup protection vs primary database protection — backup copies carry the sensitivity of the data they contain.
- Non-production convenience vs exposure reduction — realistic testing does not justify unnecessary sensitive copies.
- Outsourced operation vs accountability — vendor may perform work; organization remains answerable.
- Metric families — implementation vs awareness vs protection vs incident vs proliferation.
Ten-item chapter gate
Before moving to timed questions, explain without notes:
- Vulnerability, Threat, Risk—without swapping the terms.
- Authentication → Authorization → Access plus Entitlement and Audit using one employee.
- Why one report can have one confidentiality level but multiple regulatory categories.
- Persistent vs Dynamic and In-flight vs In-place masking from scenarios.
- Excessive privilege vs legitimate-privilege abuse vs privilege elevation.
- Monitoring vs independent Audit.
- Why Data Security Policy needs measurable standards and controls beneath it.
- Role grids vs role hierarchies vs CRUD/CRUDE vs RACI.
- Why security Metadata / enterprise data modeling are needed to locate sensitive data.
- Why outsourcing/cloud can move control operation but not organizational accountability.
Chapter gate: if you cannot explain at least 8 of 10 without notes, revisit the relevant lesson and Battle Cards before timed practice.
One-sentence Chapter 7 teach-back
Protect the right data for the right reasons, give the right roles the minimum sufficient access, enforce the rules with traceable controls, and preserve evidence so independent assurance can prove the system works.