PSI

5.9 Identify protected data in a network

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

---

Definition:
Protected Sensitive Information (PSI) is any type of data that must be protected because its exposure could harm individuals, organizations, or the security of IT systems. PSI is a broader category than just Personally Identifiable Information (PII) because it can include both personal and organizational sensitive information.

Think of PSI as data that requires careful handling due to legal, regulatory, or business confidentiality requirements.

---

Types of PSI in IT Environments

1. Personally Identifiable Information (PII)
   • Information that identifies a specific person.
   • Examples in IT systems:
     • Employee usernames and passwords stored in Active Directory.
     • Email addresses and phone numbers in a corporate database.
     • Social Security numbers (SSNs) in payroll systems.
2. Payment Card Information (PCI)
   • Data related to financial transactions.
   • Examples:
     • Credit or debit card numbers stored in payment processing servers.
     • Cardholder names and expiration dates in e-commerce databases.
   • Often regulated by PCI DSS (Payment Card Industry Data Security Standard).
3. Health Information (PHI / HIPAA Data)
   • Protected Health Information is sensitive medical data.
   • Examples:
     • Patient records in hospital management systems.
     • Health insurance details in an enterprise HR system.
   • Regulated by HIPAA in the U.S.
4. Intellectual Property (IP) and Confidential Business Data
   • Company secrets, research, or designs.
   • Examples:
     • Source code repositories on Git servers.
     • Proprietary algorithms stored on internal servers.
     • Internal financial reports in SharePoint or corporate storage.
5. Credentials and Authentication Data
   • Sensitive login information used to access systems.
   • Examples:
     • SSH private keys for server access.
     • API keys stored in cloud environments.

---

How PSI Appears in Networks

In a typical IT network, PSI can be found in many places:

• Databases: Stores PII, PCI, and business-sensitive data.
  • Example: A MySQL database storing customer emails, payment info, or account details.
• File Shares and Cloud Storage: Sensitive documents may be stored in shared drives or cloud platforms.
  • Example: HR shares PDFs containing employee data on SharePoint.
• Emails and Messaging Systems: PSI can travel in emails or chat systems.
  • Example: Sending payroll spreadsheets through company email.
• Applications and APIs: Apps that process sensitive information can expose PSI if not secured.
  • Example: A web portal API returning user profiles containing phone numbers and addresses.
• Backups and Logs: Sometimes PSI is stored in backups or system logs.
  • Example: Security logs recording failed login attempts including usernames.

---

PSI Handling in CyberOps

As a cybersecurity professional, recognizing and protecting PSI is critical. Here’s what you need to focus on:

1. Identification
   • Know where PSI resides in your network.
   • Use tools like DLP (Data Loss Prevention) software to detect sensitive information in files, emails, or databases.
2. Classification
   • Assign sensitivity levels to PSI.
   • Example: “Confidential – Only HR can access” vs. “Internal Use – Any employee can view.”
3. Protection
   • Encrypt PSI in transit and at rest.
   • Control access using least privilege principles.
   • Monitor PSI access and detect unusual activity.
4. Regulatory Compliance
   • Understand which PSI types are regulated (e.g., PCI DSS for card data, HIPAA for health data).
   • Ensure network policies meet these regulations.
5. Incident Response
   • Have procedures ready in case PSI is exposed.
   • Example: Immediate isolation of a compromised server storing customer data.

---

Key Exam Points for PSI (5.9.b)

• PSI is broader than PII; it includes any sensitive data needing protection.
• Common types: PII, PCI, PHI, intellectual property, credentials.
• PSI can exist in databases, file storage, email systems, applications, and backups.
• Cybersecurity measures:
  • Identification and classification of PSI.
  • Encryption and access control.
  • Monitoring and compliance with regulations.
• Exposure of PSI can lead to data breaches, legal issues, and reputational damage.

---

Easy IT Example for Students

Imagine a corporate network:

1. HR database → stores employee SSNs → PSI: PII
2. E-commerce database → stores customer credit card info → PSI: PCI
3. Git repository → contains proprietary software code → PSI: Intellectual Property
4. Server logs → record failed login attempts with usernames → PSI: Credentials

A CyberOps associate must know where this PSI lives, classify it, and apply protections like encryption, access control, and monitoring.