<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: data-security
description: >-
  Data security including data classification, data loss prevention (DLP),
  encryption at rest and in transit, database security, data masking and
  tokenization, secure data destruction, data access governance, cloud data
  security (CASB/DSPM), and data breach response procedures.
domain: cybersecurity
subdomain: data-security
tags:
  - dlp
  - data-classification
  - encryption
  - database-security
  - tokenization
  - data-masking
  - casb
  - dspm
  - data-governance
  - data-destruction
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1005", "T1039", "T1048", "T1530", "T1565"]
  nist-csf: ["PR.DS-1", "PR.DS-2", "PR.DS-3", "PR.DS-5", "PR.DS-6"]
  frameworks: ["NIST SP 800-88", "PCI DSS Req 3-4", "GDPR Art. 32"]
---

# Data Security

## When to Use

Activate when the operator asks about data classification, DLP, encryption,
database security, data masking, tokenization, secure deletion, CASB/DSPM,
or data breach procedures.

Mode: `[MODE: ARCHITECT]` for data security design; `[MODE: BLUE]` for DLP operations; `[MODE: PRIVACY]` for data protection.

## Quick Reference

| Control | Tool / Method | Data State |
|---------|--------------|------------|
| Encryption at rest | AES-256-GCM via KMS | Storage |
| Encryption in transit | TLS 1.3 | Network |
| Field-level encryption | Application-layer encryption | Storage |
| Tokenization | Vault Transit / AWS Payment Cryptography | Processing |
| Data masking | Dynamic masking in database views | Access |
| DLP endpoint | Microsoft Purview / Symantec DLP | Endpoint |
| DLP network | Network DLP proxy / CASB | Network |
| Classification | Microsoft Purview / Titus / manual labels | All states |
| Secure deletion | NIST 800-88 (Clear/Purge/Destroy) | Destruction |
| DSPM | Wiz / Laminar / Dig Security | Cloud |

## Workflow

### 1. Data Classification

```
Classification levels:
├── Public — No restrictions, published information
├── Internal — Default classification, business operations
├── Confidential — Business-sensitive, competitive advantage
├── Restricted — Regulated data (PII, PHI, PCI, trade secrets)
└── Top Secret — Highest sensitivity, need-to-know only

Classification triggers:
├── PII: Names, SSN, DOB, addresses, biometrics → Restricted
├── PHI: Medical records, health data → Restricted (HIPAA)
├── PCI: Card numbers, CVV, cardholder data → Restricted (PCI DSS)
├── Financial: Revenue, forecasts, M&A → Confidential
├── Source code: Proprietary algorithms → Confidential
├── Credentials: API keys, passwords, tokens → Restricted
└── Legal: Attorney-client communications → Restricted

Automated classification:
├── Content inspection: Regex patterns for SSN, CC#, etc.
├── Context-based: File location, application, user role
├── ML-based: Trained models for document classification
└── User-applied: Manual labels via classification toolbar
```

### 2. Data Loss Prevention (DLP)

```
DLP policy design:
├── Endpoint DLP
│   ├── Block USB copy of classified files
│   ├── Prevent screenshot of restricted applications
│   ├── Monitor clipboard for sensitive data patterns
│   └── Restrict printing of confidential documents
├── Network DLP
│   ├── Inspect email attachments for PII/PHI/PCI
│   ├── Block upload of classified files to personal cloud
│   ├── Monitor DNS for data exfiltration (encoding in queries)
│   └── Inspect HTTPS via TLS inspection proxy
├── Cloud DLP (CASB)
│   ├── Monitor SaaS sharing (OneDrive, SharePoint, Google Drive)
│   ├── Detect overshared files (public links with sensitive data)
│   ├── Shadow IT detection (unauthorized cloud services)
│   └── API-based scanning of cloud storage
└── Policy actions
    ├── Monitor: Log and alert (least disruptive, start here)
    ├── Notify: Warn user, allow override with justification
    ├── Block: Prevent action (for highest sensitivity)
    └── Encrypt: Auto-encrypt before allowing transfer

Detection patterns:
├── SSN: \d{3}-\d{2}-\d{4}
├── Credit card: Luhn-valid 13-19 digit numbers
├── PHI: Medical record numbers, diagnosis codes (ICD-10)
├── API keys: Regex for provider-specific formats (sk-..., AKIA...)
└── Custom: Company-specific patterns (project names, internal codes)
```

### 3. Database Security

```bash
# Database audit configuration
# PostgreSQL
ALTER SYSTEM SET log_statement = 'all';
ALTER SYSTEM SET log_connections = on;
ALTER SYSTEM SET pgaudit.log = 'all';

# MySQL
SET GLOBAL general_log = 'ON';
SET GLOBAL audit_log_policy = 'ALL';

# Hardening checklist:
# ├── Remove default accounts and passwords
# ├── Restrict network access (bind to internal interface)
# ├── Enable TLS for all connections
# ├── Implement row-level security where applicable
# ├── Use parameterized queries (prevent SQLi)
# ├── Encrypt sensitive columns (field-level encryption)
# ├── Regular backup with encryption
# └── Audit all DDL and privileged operations
```

### 4. Secure Data Destruction (NIST 800-88)

```
Sanitization methods:
├── Clear: Logical techniques (overwrite, reset)
│   ├── Software overwrite (1-3 passes)
│   ├── Factory reset (mobile devices)
│   └── Suitable for: Reuse within organization
├── Purge: Physical/logical techniques resistant to lab recovery
│   ├── Cryptographic erasure (destroy encryption key)
│   ├── Block erase (SSD TRIM/Secure Erase)
│   ├── Degaussing (magnetic media only)
│   └── Suitable for: Reuse outside organization
└── Destroy: Physical destruction rendering unrecoverable
    ├── Shredding (NSA/CSS EPL approved cross-cut shredder)
    ├── Disintegration
    ├── Incineration
    └── Suitable for: Highest sensitivity, end of life

Documentation required:
├── Asset identifier (serial number, asset tag)
├── Sanitization method used
├── Date and performing technician
├── Verification method and result
└── Certificate of destruction (for third-party services)

# Cryptographic erasure (fastest for encrypted volumes)
# Destroy the encryption key → data is irrecoverable
# Requires: Encryption was always enabled, key management is solid
```

### 5. Data Security Posture Management (DSPM)

```
DSPM capabilities:
├── Discovery: Find all data stores across cloud environments
├── Classification: Auto-classify sensitive data at rest
├── Access analysis: Who can access what data? Overprivileged?
├── Risk assessment: Unencrypted? Public? Misconfigured?
├── Compliance mapping: Does data handling meet regulatory requirements?
└── Remediation: Automated fixes for common misconfigurations

Key metrics:
├── % of data stores discovered and classified
├── % of sensitive data encrypted at rest
├── # of overshared/public data stores
├── # of data stores without backup
├── Mean time to remediate data exposure
└── Data access anomaly detection rate
```

## Verification

- [ ] Data classification policy defined and communicated
- [ ] DLP policies active on endpoint, network, and cloud
- [ ] Encryption at rest for all sensitive data stores
- [ ] Database security hardening applied (audit, TLS, access control)
- [ ] Secure destruction procedures documented and followed
- [ ] DSPM scanning cloud environments for data exposure
- [ ] Data breach response plan tested via tabletop exercise
