Asset Security Flashcards
What is the purpose of a classification system?
To ensure information is marked in a way that only those that need access can see the information.
Once data has been classified it retains that classification for its entire existence and a review is not necessary - True or False?
False. A periodic review should be done to recertify the classification is still appropriate.
Who is responsible for classifying the data?
The Data Owner
What does the acronym ITAM stand for?
IT Asset Management
What two things should you consider when classifying information and supporting assets?
Sensitivity and Criticality
What is the difference between data ownership and data custodianship?
Data ownership is the accountability and responsibility for the systems around the management of data. Custodianship is the implementation of those controls and the management of data within those systems.
At a high-level, information has a life that consists of _________, ____ and __________.
Creation, Use and Destruction.
Define “Data Remanence”?
Data remanence is the residual physical representation of data that has been in some way erased.
In the context of a data security control, what is the objective of a baseline?
The objective of a baseline protection is to establish a minimum set of safeguards to protect all or some of the IT systems in the organisation.
What does the US DoD 5220.22-M standard define when disk wiping?
The US DoD 5220.22-M method requires overwriting all addressable storage and indexing locations on the drive three times: with zeros (0x00), complement (0xFF) and random characters; and then verifies all writing procedures.
Name three methods of secure destruction?
- Wiping
- Degaussing
- Shredding
The Anytown Hospital Gift Shop POS system was the target of a successful cybercrime attack. The POS system stored product SKUs, postcodes and transaction amounts. Is this information legally protected?
a. No, SKUs, postcodes and transaction amounts are not legally protected.
b. Yes, postcodes and transactions are classified as NPPI.
c. Maybe, it depends upon the number of records.
d. Yes, patient information is legally protected underr HIPAA.
Answer: a
No, SKUs, postcodes and transaction amounts are not legally protected.
Don’t be tempted by d because it’s a hospital, and c because PCI does look at the number of records. FOCUS only on the information that has been provided.
What does the acronym COPPA stand for?
Children’s Online Privacy Protection Rule (US)
Which of the following statements best defines the concept of privacy?
a. The right of an individual to opt out of data use and collection.
b. The right of an individual to conduct their daily lives unnoticed.
c. The right of an individual to be compensated for the use of their personal information.
d. The right of an individual to control the use of their personal information.
Answer: d
The right of an individual to control the use of their personal information.
Select the terms to correctly complete the sentences below.
a. __________ applies to the privacy and security of financial records.
b. __________ applies to the privacy and security of medical records.
c. __________ applies to the security of payment card data.
d. __________ requires parental consent for data collection.
e. __________ applies to the privacy of educational records.
f. __________ is based on the OECD principles.
- PCI DSS
- GLBA
- Data Protection Directive
- COPPA
- HIPAA
- FERPA
a. GLBA applies to the privacy and security of financial records.
b. HIPAA applies to the privacy and security of medical records.
c. PCI applies to the security of payment card data.
d. COPPA requires parental consent for data collection.
e. FERPA applies to the privacy of educational records.
f. Data Protection Directive is based on the OECD principles.
