DAT9 finding classesData Protection
What happens to the data if everything else fails?
The Data domain covers the controls that determine blast radius. Every other domain is about preventing access; this one is about limiting what access is worth. Encryption, classification, retention, and injection defence decide whether a compromise is an incident or a notifiable breach.
What this domain covers
- Encryption at rest and in transit, and key management
- Injection defence in data-access paths
- Data classification and inventory
- Retention, deletion, and data-subject rights
- Backup integrity, isolation, and restoration testing
Distribution across tiers
Typically owned by Data platform / application engineering.
BCN-T1-DAT-00124 hoursInjection Flaws on Internet-Facing Applications
SQL, NoSQL, OS command, or template injection reachable from an unauthenticated request.
BCN-T1-DAT-00224 hoursUnauthenticated Database Endpoints
MongoDB, Redis, Elasticsearch, or similar services accepting internet connections with no authentication.
BCN-T1-DAT-00348 hoursUnencrypted Sensitive Data at Rest
Regulated or business-critical data stored without encryption on systems exposed to compromise.
BCN-T2-DAT-00130 daysEncryption Below Regulatory Standard
Data is encrypted, but with algorithms, key lengths, or key management that fail the applicable requirement.
BCN-T2-DAT-00230 daysData Retention and Deletion Non-Compliance
Personal or regulated data kept beyond its lawful basis, or deletion requests not honoured throughout.
BCN-T2-DAT-00330 daysAbsent Data Classification
No scheme identifying which data is sensitive, where it lives, and which controls apply.
BCN-T3-DAT-00190 daysNo Data Loss Prevention Coverage
No technical control detecting or preventing sensitive data leaving approved channels.
BCN-T3-DAT-00290 daysUnverified Backup Restoration
Backups are taken but restoration has never been tested end to end.
BCN-T3-DAT-00390 daysDatabase Configuration Hardening
Database settings diverging from benchmark without creating direct exposure.