The Data Security Life Cycle

Destroy

Create

Store

Creating the knowledge, which is usually in tacit knowledge at this point.

Storing or recording it in some fashion (which makes it explicit).

Using the knowledge, which may cause the information to be modified, added to, or have parts of it deleted.

Sharing the data with other users, whether as a copy or a move of the data from one storage location to another.

Archiving the data, so that a version of it at a moment in time is protected from further change, and can be available for reuse at a later date, perhaps by other users.

Disposing of the data, perhaps by destroying all copies of it, so that it is no longer available for use.

These sets of actions are shown in simple form in the figure, which should not be taken to imply a fixed sequence of steps. Yes, creation of the data comes first, and destruction comes last.

But the intervening steps of storage, use (and modification), sharing, and archiving can happen many, many times, in any order necessary to meet the needs of all of the users of that data. But for the sake of simplicity, we can think of this as a life cycle mode for data security.

Let's look at these different data security life cycle stages more closely.

Create

Creation is the generation or acquisition of new content, or the iteration or updating of existing content. The creation phase is the preferred time to classify content according to its sensitivity and value to the organization. Careful classification is important since security controls will be based on that

Store

Storing is the process of committing the data to some sort of storage media and, in most cases, happens at the same time as creation. When storing data, it should be protected in accordance with its classification. Unless the classification is done correctly, poor security controls could be implemented if content is classified incorrectly. This is why the owners need to classify their assets; the owners are in the best position to understand the value of those assets to the organization, which is what the classification should be based on.

classification level, and baseline controls, such as encryption, access controls, logging and monitoring, and redundancy, should be implemented to avoid risks.

Use

Data is accessed, viewed, processed, or used in some sort of way. Data in use is usually most vulnerable because it is probably in clear text at that point and may be transported into unsecure locations such as servers and workstations.

Share

Information is shared with others, such as between users, to customers, and to partners, vendors, and other third parties. Not all data should be shared, and not all sharing should present a threat, but since data that is shared is no longer under the organization's control, maintaining

To be processed, data must be unencrypted. Controls, such as data loss prevention (DLP), digital rights management (DRM), and access controls, should be in place to protect the data in use and prevent unauthorized access.

security can be most difficult. Data should only be shared based on its classification and only to those that are authorized for certain classifications. Technologies, such as DLP, can be used to detect unauthorized sharing, and DRM technologies can be used to maintain control over the information.

Archive

Data that is leaving active use may need to be stored long term. Archiving data for a long period of time can be challenging, especially from a security perspective. Considerations of security through the archive period may affect data access procedures. The technology used may present challenges as well. Imagine if data is stored on some media and then needs to be retrieved a number of years later.

Destroy

The destruction phase can have different technical meanings according to usage, data content, and applications used. Data destruction can take many forms, from a simple delete or erase, to permanent data

Will the technology still exist to read the media? Data placed in archive must still be protected according to its classification level. Legal and regulatory requirements must also be addressed, and different tools and providers might be part of this phase and, therefore, may have shared responsibilities for the protection of archived information.

destruction using physical or digital means. As usual, consideration should be given according to value - the classification of the data.

Even though the phases described, create, store, use, share, archive, destroy, are those depicted in the blog at Securosis (information security research firm), the phases depicted in our diagram really focus on the security requirements as data moves through the different phases of its life cycle.

The phases depicted in our diagram are identify and classify, secure, monitor, recover, disposition, archive, and defensible destruction. These phases imply the security requirements of each of these phases.

Source: https://securosis.com/blog/data-socurityin-the-saas-age-focus-on-what-you-control

The data life cycle guidance provides a framework to map relevant use cases for data access, while assisting in the development and application of appropriate security controls within each life cycle stage.