Asset Security Flashcards
What is the purpose of classification?
To drive what CONTROLS must be put in place to protect the information.
What are the three C’s of classification?
Cost: Determine the value of the data.
Classify: Create criteria for classification.
Controls: Determine the baseline security configuration for each classification.
Who determines the classification of data?
The Data Owner
Who maintains the data?
Data Custodian
What are the military classification labels from highs to lowest?
Top Secret
Secret
Sensitive, but unclassified (SBU)
Unclassified
What are classification terms normally associated with nongovernmental organizations?
Private
Proprietary
Sensative
Describe some steps for system hardening and baselining.
- Remove unnecessary services
- Install latest patches
- Rename default accounts
- Change default settings
- Enable security configurations like auditing, firewalls, updates, etc.
- Don’t forget physical security.
What comprises the actions that organizations take to prevent unauthorized EXTERNAL parties from gaining access to sensitive data?
Data Leak Prevention (DLP)
What type of DLP pertains to data in motion?
Network Data Loss Prevention
NDLP products are normally implemented as appliances that are deployed at the perimeter of an organizations’ network.
What type of DLP pertains to data at rest?
Endpoint DLP
Software running on each protected endpoint.
What type of DLP pertains to data in use?
Endpoint DLP
Software running on each protected endpoint.
What should a data retention policy contain?
Address what data is to be retained, where, how, and for how long.
Must consider legal, regulatory, and operational requirements.
What is the NIST SP that provides guidelines to combat data remanence?
NIST SP 800-88 “Guidelines for Media Sanitization”
What is the term for the process of removing or reducing magnetic field patterns on conventional disk drives or tapes?
Degaussing
What is the 4 step information life cycle?
Acquisition
Use
Archival
Disposal
The methodology that identifies the path to meet user requirements.
Data Modeling
The residual physical representation of data that has been in some way erased.
Data Remanence
The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique.
Purging
An assessment of quality based on standards external to the process and involves reviewing of the activities and quality control processes to ensure final products meet predetermined standards of quality.
Quality Assurance
An assessment of quality based on internal standards, processes, and procedures established to control and monitor quality.
Quality Control (QC)
