Anki - Organization Security 2 Flashcards
What is Data Handling or Document Management?
The process of managing information over it’s lifecycle - from creation to destruction
What is a Data Policy?
The security controls that will be applied to protect data.
What four roles exist in a Data Governance Policy?
- Data Owner
- Data Steward
- Data Custodian
- Privacy Officer
Describe the role of a Data Owner
Senior/Exec role, responsible for:
- Maintaining confidentiality, integrity and availability of data
- “Labeling the data” (determining who has access and the data’s sensitivity)
- Ensure and select it’s security controls (backups, access control etc)
- Selecting a Steward and Custodian
Describe the role of a Data Steward
Responsible for data quality, and must ensure data is:
- Identified/labelled appropriately (metadata)
- Collected and stored in a way that complies with laws/regulations
Describe the role of a Data Custodian
Responsible for managing the system where data is stored, including enforcing:
- Access control
- Encryption
- Backup/recovery measures
Describe the role of a Privacy Officer
Responsible for any PII (personally identifiable information) assets managed by the company.
What is Data Classification?
Classification restricts who may see the document contents based on the data’s sensitivity.
What are the five levels of data classification?
- Unclassified (public)
- Classified (private/restricted/internal use only/official use only)
- Confidential (or low)
- Secret (or medium)
- Top-Secret (or high)
How should classified, confidential, secret and top-secret data be protected?
They should all be encrypted for storage and transmission.
What is the MAC model when referring to data classification?
Mandatory Access Control
What is PII? Give some examples
Personally identifiable information
- SSN
- Name
- DOB
- Phone number
- Biometric Data
Give an example of data that is “sometimes” considered PII
A static IP address is PII, but an IP address dynamically assigned by the ISP may not be.
What is PHI? Give some examples
Protected health information
- Medical records
- Insurance records
- Hospital records
- Lab results
Why is PHI used as a target for criminals?
- PHI is valuable on the black market
- Criminals exploit data for insurance fraud or to blackmail victims
- PHI data cannot be changed unlike a credit card or bank account number
What is IP?
Intellectual property created and owned by a company. Target for competitors, foreign governments and counterfeiters.
What is Data Retention?
The process to maintain the existence of and control over data in order to comply with policies/laws/regulations. E.g. Keeping audit logs for HIPAA
What is Data Sanitation and Disposal Policy?
Procedures for disposing of
- obsolete information and equipment
- storage devices
- paper records
Why should you shred all paper documents before disposal, even innocuous ones?
Attackers “Dumpster Dive” for information for impersonation attacks (e.g. employee phone numbers or calendar appts)
How should paper confidential or secret documents be disposed of?
Finer cross-shredding, incineration or pulping.
Shedders have levels that correspond to the size a sheet is reduced to. L1 is 12mm strips, L6 is 0.8x4mm.
What is Media Sanitization or Remnant Removal?
The decommission of media (hard drives, flash drives/SSDs, tape media, CD and DVD ROMs, printers, old PCs)
What are the 3 main reasons Remnant Removal is important?
- Own company’s confidential data could be compromised.
- Third-party data could be compromised
- Software licensing could be compromised.
Why is just formatting a hard drive or device not considered proper remnant sanitization?
Deleted data is marked as available for writing, and the data they contain will only be removed as new files are added.
What is zero-filling?
A process of overwriting or disk wiping, where each bit is set to zero.
What is a flaw of zero-filling?
Can leave patterns that can be read with specialist tools.
Better to overwrite with pseudorandom ones and zeros, but is time consuming and needs special software.
What is low-level formatting?
Similar to disk-wiping, it cleans data from sectors; and does’t re-create the sector layout. Whereas at the factory, a “low-level format” creates cylinders and sectors on the disk.
What is degaussing?
Exposing a disk to a powerful electromagnet to disrupt the magnetic pattern.
Requires costly machinery and usually renders the disk unusable.
What is pulverizing?
Mechanically destroying the disk e.g. drill or hammer.
Not suitable for highly confidential data as fragments can be analyzed.
How should you dispose of Optical Media?
Shredders - because CDs and DVDs cannot be reformatted.
Give five methods of Media Sanitization/Remnant Removal.
- Overwriting/Disk Wiping
- Low-level formatting
- Pulverizing
- Degaussing
- Disk encryption
