Asset Security Flashcards
What is the purpose of classification?
To drive what CONTROLS must be put in place to protect the information.
What are the three C’s of classification?
Cost: Determine the value of the data.
Classify: Create criteria for classification.
Controls: Determine the baseline security configuration for each classification.
Who determines the classification of data?
The Data Owner
Who maintains the data?
Data Custodian
What are the military classification labels from highs to lowest?
Top Secret
Secret
Sensitive, but unclassified (SBU)
Unclassified
What are classification terms normally associated with nongovernmental organizations?
Private
Proprietary
Sensative
Describe some steps for system hardening and baselining.
- Remove unnecessary services
- Install latest patches
- Rename default accounts
- Change default settings
- Enable security configurations like auditing, firewalls, updates, etc.
- Don’t forget physical security.
What comprises the actions that organizations take to prevent unauthorized EXTERNAL parties from gaining access to sensitive data?
Data Leak Prevention (DLP)
What type of DLP pertains to data in motion?
Network Data Loss Prevention
NDLP products are normally implemented as appliances that are deployed at the perimeter of an organizations’ network.
What type of DLP pertains to data at rest?
Endpoint DLP
Software running on each protected endpoint.
What type of DLP pertains to data in use?
Endpoint DLP
Software running on each protected endpoint.
What should a data retention policy contain?
Address what data is to be retained, where, how, and for how long.
Must consider legal, regulatory, and operational requirements.
What is the NIST SP that provides guidelines to combat data remanence?
NIST SP 800-88 “Guidelines for Media Sanitization”
What is the term for the process of removing or reducing magnetic field patterns on conventional disk drives or tapes?
Degaussing
What is the 4 step information life cycle?
Acquisition
Use
Archival
Disposal
