Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Asset Security > Flashcards

Asset Security Flashcards

1
Q

Information lifecycle

A

classification
categorization
ownership
maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Asset classification

A

asset is anything that has value to an org
Tangible (h/w,s/w,firmware, n/w device )
Intangible (information, data, trademark,copyright, patent, IP, image, reputation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Product life cycle :
EOL (end of life),
EOS (End of support)

A

EOS - no longer supported y vendor (sunsetting)
EOL - no longer sold by vendor but support may still be available)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Info systems lifecycle (8 phases) -
NIST SP 800 - 160

A

Stakeholders requirements
Analysis
Architectural design
Development/implement
Integration
Verification/Validation
Transition/deployment
Operate and maintenance
Retirement/disposal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Classification

A
  1. Controlled Information:
    PII - Personally identifiable information
    PHI - protected healthcare information
    CHD - card holder data
  2. Intellectual Property
  3. Financial data
  4. Others such as HR data, sensitive emails n texts, security reports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data Classification Labels

A

Top secret : highest level - exceptional grave damage
secret : serious damage
confidential : damage
sensitive , but unclassified (SBU) : doesn’t cause damage
Unclassified : doesn’t violate confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Commercial terms - classification labels

A

Public, official use only, internal use only, and company proprietary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Most critical data

A

credit cards
financial information
healthcare data
customer PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

data classification criteria

A

Value : info worth to the company
Age : how current is the info, does org need 5yr old data
Useful life: at what point is data in your sys no longer worth protecting
Personal association: medical records, case files, personnel files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Distribution of classified information

A

Court orders/legal mandates such as FOIA requests release of info that would otherwise remain protected

FOIA - Freedom of info act

Management can approve distribution of classified info outside of the org, in conjunction with NDA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Regulated data-based classification

A

PHI
- associated with HIPAA
PII
- name, address, SSN, DOB, license
CHD
- cc number
- cardholder name
-exp date
- CVV
- PCI DSS - payment card industry data security standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data Ownership

A

Business/Mission Owner
Data/Information Owner
System Owner
Custodians
Users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Business/Mission Owner

A

Responsible for the success of an org
high ranking officials are responsible for establishment of an orgs computer security prg n goals
set priorities to support the mission of the org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data Owner

A

Member of mgmt
corporate responsibility for protection of specific data
take into consideration laws, policies, regulations, budget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

System Owner - NIST 800-18

A

responsible for the comp system (h/w n s/w)
Focus on system design, plan n updates
hands on responsibilities (patching, backup) are delegated to custodians

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Custodian

A

Perform hands on activities to achieve data protection requirements dictated by data owners

not decision makers

actions taken will be in accordance with policy, procedure, / owner approved changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

User

A

Individuals who have been granted access to, n leverage data during the course of their function

operate within bounds of AUP helps to ensure data security is maintained

responsible to report security incidents that they are aware of

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sensitive data collection limitation

A

OECD - Org for economic cooperation n development directly addresses collection limitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data controllers and processors

A

Controllers: Org that creates /manages sensitive data
eg: salary data managed by HR dept

Processors: 3rd party companies that access an org’s sensitive data
eg: outsourced payroll company

data controller bears the legal responsibility that the processor actually implements the necessary security measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data retention policies

A

Determine how long specific types of data should be retained by the org
ESI - Electronically stored info destroyed as per data retention/destruction policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Records retention issues : email

A

Orgs should purge email after the retention period has expired

also consider local archives (pst files) - personal storage table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Object reuse

A

concept of reusing storage media after its initial use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Data Remanence

A

Info that persists on media after attempted removal
Remnants might only be accessible with forensic tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Media Storage

A

Paper printouts
Data backup tapes
CDs
Diskettes
Hard drives
Flash drives

storage ares: onsite, offsite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Data storage and memory terms

A

Real, main or primary memory
Secondary memory
WORM - Write once, read many
Volatile storage
non-volatile storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Sequential access memory/storage
Random access

A

Storage devices that are read and written to in a sequential order

older n slow technology used by magnetic tapes

Random access: that allow for jumping to a location n reading/writing of data

faster technology n more complex

27
Q

Real/primary memory

A

uses RAM
Data storage that is directly accessible by CPU
volatile
higher speed data retrieval
consists of registers, SRAM, DRAM
Data lost when power is lost

28
Q

Registers, SRAM, DRAM

A

Registers: small storage locations used by the CPU to store instructions n data
located within CPU
fastest of all RAM

SRAM - Static RAM
Very fast, less amount, used for cache memory
more expensive than DRAM

DRAM - Dynamic RAM
Refreshed on a regular basis
cheapest n most common

29
Q

Volatile and non-volatile storage

A

volatile: Registers, SRAM, DRAM
power lost data lost

non-volatile: secondary storage like hard drives, firmware also non-volatile
not able to be directly accessed by CPU
Slower retrieval

30
Q

ROM, Firmware

A

ROM:Non-volatile
allows system to be booted

Firmware : stored on a type of ROM Chip
maintained on non-volatile storage
firmware is generally the controlling s/w for a device that is placed in special type of ROM

31
Q

Types of ROM

A

PROM
EPROM
EEPROM
PLD

32
Q

Media Sanitization

A

Controlling access to media
proper disposal of media
sanitising media:
–removing data
– wiping/overwriting
–degaussing - applying large magnetic field to erase magnetic media
– Destruction

33
Q

Media sanitisation methods: clear, purge, Destroy

A

security categorisation high - destroy
medium - purge

34
Q

Media Sanitization Methods : Clear

A

data is overwritten
clearing is done locally
data is not recoverable via the device interface

35
Q

Media Sanitization Methods : Purge

A

bypass the computers OS to securely remove data
purge ensures that no data is recoverable
eg: firmware level erase
cryptographic erase (CE)
degaussing

36
Q

Media Sanitization Methods : Destroy

A

The storage device rendered unusable
these methods are designed to completely destroy media
eg: methods include
Disintegrate (separating into component parts)
Pulverize (act of grinding to a dust/powder)
Melt ( solid to liquid state)
Incinerate (burning to ashes)

Shred: paper shredders to destroy flexible media such as diskettes

37
Q

Flash memory and SSD Remanence

A

Flash memory is based on EEPROM tech
SSDs use a combination of flash memory n DRAM

Degaussing has no effect on EEPROM

The remanence properties of EEPROM, and flash memory are different from RAM/physical media

38
Q

Options for erasing flash drives and SSDs

A

use encryption, never store unencrypted data
2 common options if uncrypted data
– use ATA secure erase
– physically destroy the device

physical destruction is more expensive but more secure

39
Q

Prepare the media for reuse (processes)

A

Erasing, clearing and overwriting if used in the same classification env
Purging , sanitizing, degaussing if media used in different classification env

40
Q

Goals of managing backup media

A

preventing disclosure, destruction, and alteration of data

41
Q

Provisioning

A

deals with preparing a user, service, system for active deployment

provisioning ends with the instantiation of the user, service, or system into the operational status

security baseline and configuration mgmt are key principles in the provisioning phase

42
Q

WORM media remanence

A

WORM media commonly used for legal purposes
provides integrity assurance
worm media -CD-R, DVD-R
Destruction is the best method, others no effect

43
Q

Config mgmt

A

security config mgmt is a fundamental security principle

44
Q

PoLP

A

Min necessary
achieving min necessary is much more difficult than it sounds

45
Q

Baseline security

A

start with free guidance
1. CIS - Center for internet security - includes OS gudes, server, app guides
2. Microsoft Security guides
3. NIST SP800s
4. DISA STIGs - security technical implementation guides from the defence info systems agency –for US DoD

46
Q

Security Metrics

A

provide meaningful security data
helps an org to understand threats n vulns
helps to make better decisions related to security

47
Q

Continuous monitoring and improvement

A

leads to continuous posture improvements

48
Q

Best practices and standards

A

adhere to industry accepted best practices
standards:
ISO : International organization for standardization
NIST : national institute of standards n technology
IETF:internet engineering task force

49
Q

ISO

A

Grouped as 27000 series
ISO 27001 - (Auditing) provides security requirements , used for 3rd party verification/attestation
ISO 27002 (Best Practices)- Most popular providing guidance on security

50
Q

SABSA

A

Sherwood applied business security architecture
open source n vendor neutral framework for enterprise security architecture

maintained by non profit SABSA institute

51
Q

COBIT - 5 domains

A

Evaluate , Direct and Monitor (EDM)
Align, plan and organize (APO)
Build, acquire and Implement (BAI)
Deliver, Service n support (DSS)
Monitor , Evaluate and Assess (MEA)

52
Q

COBIT

A

Control objectives for information and related technology

COBIT provides guidance in the enterprise governance of information and technology (EGIT)

COBIT 2019 defines40 governance n mgmt objectives across 5 domains

53
Q

NIST 800 Series SP

A

The US national institute of standards and technology issues best practice publications - 800 series of SP (Special publications)
NIST 800-34 : contingency planning
NIST 800-37 : risk mgmt
NIST 800-53 recommended security controls
NIST 800-115: Security testing and assessment

NIST 800-18 (Security plans)

54
Q

IETF (internet standards)

A

The internet engineering task force
focus on internet standards

IETF manages requests for comments (RFC)
RFCs are internet standards documents

55
Q

Scoping , Tailoring,

A

Scoping: determining applicable portions of standards that will be followed

eg: org that doesnt use wireless networks declares wireless security controls out of scope

Tailoring: customizes a standard for an irg

56
Q

DLP

A

DLP Attempts to prevent n detect unauthorized exfiltration of data from systems n networks
1. Host based solutions (at rest) - use DLP agents
2. Storage based DLP Solutions(at rest)
3. Network based DLP Solutions(in transit)
4. Cloud based DLP Solutions protect all 3 (rest, in use), transit)

57
Q

Data States

A

at rest : stored on disk, tapeUSB, in firmware
in transit : data being transferred across a network
in use : data being actively accessed inside an app

controls : DLP (Data loss prevention) can protect data in all three states

58
Q

Storage based DLP

A

Used on SANs (storage area network) and NAS (network attached storage) and cloud based storage

59
Q

network based DLP

A

Packet sniffers, nextgen firewalls, email based solutions

60
Q

Digital rights mgmt (DRM)

A

Is a suite of technologies designed to protect copyrighted digital media

eg: ebooks, games, music, movies etc

61
Q

Pillars of CASB

A

Visibility
Data Security
Threat protection
Compliance

62
Q

CASB (Cloud access security broker)

A

provides cloud security connection/enforcement points
eg: nextgen firewalls, WAF

CASB may be used to provide
- authentication (SSO)
-Authorization
-DLP
-Malware detection n prevention
-Logging, alerting etc

63
Q

DRM Controls

A

preventing editing n saving
preventing forwarding n sharing
preventing printing ( or limiting the no of prints)
preventing screen grabbing
document expiry
document revocation
locking docs to devices , IP Addresses and country locations
watermarking docs with unique user info to establish an identity

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions