Cybersecurity

Session 4

Data Protection: Documents, Files and Validation

Apply robust encryption tools to secure sensitive documents and files, ensure data
integrity, and implement validation best practices.

-Dr Shuchi Dhir

 Know Your Facilitators
Dr Shuchi has over 15 years of experience teaching and mentoring, effectively
guiding graduate and postgraduate students in diverse computer science and
cybersecurity areas.
Dr Shuchi has completed her Master’s ([Link]) and doctorate in Philosophy (PhD) in
computer science. She has also earned a Bachelor’s and Master’s in Computer
Applications.
Dr Shuchi has taught Master's in Cybersecurity programs at renowned universities,
including the University of San Diego, Southern New Hampshire University (SNHU),
and Edith Cowan University.
Her teaching portfolio spans advanced topics such as network security,
cryptography, and incident response, equipping students with theoretical
knowledge and hands-on expertise in cybersecurity.
Dr Shuchi has made significant contributions to the cybersecurity field through
Dr Shuchi DHIR impactful research publications in areas such as biometrics and cryptography.
Regenesys Integrated Leadership & Management
Model
Regenesys Graduate Attributes
 Ground Rules
Be On Time
Turn On Your Video (If Possible)
Stay on Mute
Use the Chat or “Raise Hand” Feature
Avoid Multitasking
Check Your Internet and Equipment
Log in with Your Name
Keep Distractions to a Minimum
Avoid Sharing Screens Without Permission
Be Respectful
Ask Relevant Questions
Follow the Host’s Instructions
Participate Actively
Stay Focused on the Topic
Do Not Record Without Permission
Keep the Content Confidential
Learning Objectives
Core Concepts Data Validation
Understand the CIA triad and distinguish between data at rest, in Validate data integrity and authenticity using cryptographic hashes and
rest, in transit, and in use. digital signatures.

Cryptography Basics Key Management

Distinguish between symmetric vs. asymmetric encryption, hashing Implement secure practices for managing keys, passwords, and recovery
hashing algorithms, and digital signatures. procedures.

Tool Selection Compliance & Best Practices

Select appropriate encryption tools for various environments (OS -native, Align with regulatory requirements (GDPR, HIPAA) and avoid common
(OS-native, Desktop, CLI, Cloud). security pitfalls.

Practical
Session Application
4: Data Protection 2
Apply hands-on encryption to files and folders, and implement
protection for Office/PDF documents.
Why Data Protection Matters
The financial, regulatory, and reputational stakes of data insecurity have never been higher.

$4.45M 4% 83%
AVG. GLOBAL BREACH COST MAX ANNUAL TURNOVER FINE REPEATED BREACHES

Source: IBM Cost of a Data Breach 2023 Under GDPR for non-compliance Orgs experiencing >1 breach

THE RISING THREAT LANDSCAPE THE PROTECTION ADVANTAGE

Data Exfiltration & Ransomware Risk Mitigation

Attackers now steal data before locking it, threatening public release
Encryption acts as a "last line of defense." Even if data is stolen, it remains
("double extortion") if ransoms aren't paid.
unreadable and useless to attackers.

Regulatory Exposure Trust & Reputation

Non-compliance with GDPR, HIPAA, or PCI DSS leads to massive fines, legal Demonstrable data protection builds customer confidence and accelerates
battles, and mandatory audits. incident response and recovery times.
 What Is Sensitive Data?
Identifying critical data assets is the first step in applying effective encryption and validation controls.

Regulated & Confidential Technical & Intellectual Property

Intellectual Property
Source code, product designs, research data, and trade secrets.

Credentials & Secrets

Passwords, API keys, private keys, and authentication tokens.

Logs & Backups

Payment Data (PCI)
System exports, database dumps, and debug logs containing sensitive info.
PAN, CVV codes, transaction histories, and banking details.
Encryption Fundamentals
CIA Triad & Data States Hashing
Ensures Confidentiality, Integrity, and Availability across data states: At One-way mathematical transformation (e.g., SHA-256) used strictly for
Rest, In Transit, and In Use. verifying data integrity, not reversibility.

Symmetric Encryption Digital Signatures

Uses a single shared key (e.g., AES). It is fast and efficient, making it Cryptographic mechanism providing integrity, authenticity, and non-
ideal for bulk data encryption. repudiation using private key signing.

Asymmetric Encryption Envelope Encryption

Uses a key pair (Public/Private) for secure key exchange and Protecting data keys with a separate key-encryption key (KEK) to
authentication (e.g., RSA, ECC). secure the key management lifecycle.

Session 4: Data Protection 5

 Common Standards & Algorithms
Using strong, modern cryptographic primitives is essential. Avoid legacy algorithms that have known
vulnerabilities.

Symmetric & Transport Asymmetric & Key Management

AES-256 (GCM/CTR) RSA-3072+ or ECC

The gold standard for data at rest. Prefer GCM mode for built-in integrity over Use RSA (3072-bit+) or Elliptic Curve (P-256/Ed25519) for secure key exchange
older CBC modes. and signatures.

SHA-256 / SHA-512 Strong KDFs

Standard hashing algorithms. Use HMAC variants when verifying data integrity Use PBKDF2, Argon2, or scrypt to safely derive encryption keys from user
with a shared secret. passwords.

TLS 1.2+ / TLS 1.3 Algorithms to Avoid

Mandatory for data in transit. Disable SSLv3 and TLS 1.0/1.1 to prevent Do NOT use MD5, SHA-1, RC4, DES, or legacy ZIPCrypto. They are compromised
downgrade attacks. and insecure.

Session 4: Data Protection 6

 File Encryption Tools Overview
Select the right tool for the job: Full-disk encryption for device security vs. File-level encryption for safe sharing.

Platform & Volume Encryption File-Level & Sharing Tools

Windows BitLocker 7-Zip (AES-256)

Native full-disk encryption that integrates with TPM chips for hardware-level security and Accessible GUI tool for creating encrypted .7z archives. Ensure AES-256 is selected over
seamless boot protection. legacy ZipCrypto.

macOS FileVault GPG / PGP

Built-in disk encryption using XTS-AES-128. Keys can be managed locally or linked to The gold standard for asymmetric encryption. Encrypt files for specific recipients using
iCloud for recovery. their public keys.

Linux LUKS / dm-crypt OpenSSL

The standard for Linux hard disk encryption, operating transparently at the block device Powerful CLI toolkit for scripting encryption operations using varied cipher suites (e.g.,
level. AES-256-GCM).

VeraCrypt (Cross-Platform) Cloud Labels (MIP)

Open-source tool for creating encrypted virtual drives or encrypting partitions on Microsoft Purview Info Protection labels that travel with the document, enforcing
Windows, Mac, and Linux. encryption wherever it goes.
 Document Encryption Methods
Secure sensitive information directly at the file level using built-in document protection and enterprise
rights management.

Built-in Document Protection Rights Management & Sharing

Microsoft Office Encryption Information Rights (IRM)

Native "Encrypt with Password" uses AES-256 (in modern versions) to Granular controls to restrict viewing, printing, forwarding, or copying
fully encrypt document contents. content even after download.

PDF Security Access Expiration

Standard AES-256 encryption with separate passwords for opening Set time limits on document access and revoke permissions remotely if a
documents and modifying permissions. device is compromised.

Sensitivity Labels Secure Channel Sharing

Automatic classification and encryption based on content policies (e.g., Always transmit encrypted files via secure channels (TLS) and share
"Confidential" label encrypts on save). passwords/keys via a separate out-of-band method.

Session 4: Data Protection 8

 Hands-On: Encrypt Files Three Ways Practical Guide: GUI vs. CLI

7-Zip GUI GPG (GnuPG) CLI OpenSSL CLI

1 Generate a key pair (one-time setup). 1 Use AES-256-GCM cipher suite.

1 Right-click file/folder and select 7-Zip > Add to archive...
2 Encrypt file for a specific recipient.
2 Add salt and pbkdf2 to prevent dictionary attacks.
2 Set Archive format to 7z.
3 Decrypt using private key.
3 Under Encryption, set method to AES-256.
3 Share the password via a separate secure channel.
4 Enter a strong, unique password.

5 Check Encrypt file names to hide metadata.

# Generate Key # Encrypt (Symmetric)

$ gpg --full-generate-key $
openssl enc -aes-256-gcm -salt -pbkdf2 -in
# Encrypt (Asymmetric) [Link] -out [Link]
$ gpg -e -r user@[Link] [Link] # Decrypt
Best for: Quick ad-hoc sharing and archiving folders with # Decrypt $
openssl enc -d -aes-256-gcm -pbkdf2 -in
non-technical recipients. $ gpg -d [Link] > [Link] [Link] -out [Link]

Session 4: Data Protection 9