Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Asset Security > Flashcards

Asset Security Flashcards

1
Q

VALUE OF ASSETS

A

Qualitative or

Quantitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

PROTECTION OF VALUABLE ASSETS

A

SHOULD BE BASED ON VALUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

EXAMPLES OF VALUABLE ASSETS

A

People

Information/data

Hardware

Reputation

Architectures

Software

Products

Processes

Intellectual Property/Ideas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IDENTIFICATION AND DISCOVERY OF ASSETS

A

Inventory

Needs to be formal process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ASSET CLASSIFICATION

A

Requires management support, commitment, and conviction

Accountability

Policies

Training/awareness/education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CLASSIFICATION PROCESS

A
  1. Asset inventory
  2. Determine and assign ownership
  3. Classify based on value
  4. Protect and handle based on classification
  5. Reassess (back to step 1)

Ensures information is market in such a way that only those with an appropriate level of clearance can have access to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CATEGORIZATION

A

The process of determining the impact of the loss of confidentiality, integrity, or availability of the information to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ASSET LIFECYCLE

A
  1. Identify and classify
  2. Secure and store
  3. Monitor and log
  4. Recover
  5. Disposition
  6. Archive or
  7. Destruction (defensible)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

EQUIPMENT LIFECYCLE

A
  1. Define requirements
  2. Acquire and implement
  3. Operations and maintenance
  4. Disposal and decommission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CLASSIFICATION VS. CATEGORIZATION

A 
CLASSIFICATION
The act of forming into a class or group
A distribution into groups, as classes according to common attributes

CATEGORIZATION
The process of sorting or arranging things into classes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CLASSIFICATION AND CATEGORIZATION SYSTEMS

A

Canada’s - Security of Information Act

China’s - Guarding State Secrets

UK’s - Official Secrets Act

US NIST’s - Federal Information Processing Standards (FIPS 199)

NIST’s SP800-60 - Guide for Mapping Types of Information and Information Systems to Security Categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DATA CLASSIFICATION POLICY

A 
Who will have access to data
How the data is secured
How long the data is to be retained
What methods should be used to dispose of data
Whether the data needs to be encrypted
The appropriate use of the data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

EXAMPLES OF CLASSIFICATION LEVELS

A

Top Secret
Company Restricted
Company Confidential
Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CLASSIFICATION ACTIONS

A

Done by owners

Data owner should decide the classification

Owners should review the classification on a regular basis and adjust it as necessary

Classification should allow for increase or decrease

Changes need to be documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

PURPOSE OF CLASSIFICATION

A

Ensure that data receive appropriate level of protection

Provide security classifications that will indicate the need and priorities for security protection

Minimize the risks of unauthorized information alteration

Avoid unauthorized disclosure

Maintain competitive edge

Protect legal tactics

Comply with privacy laws, regulations, and industry standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CLASSIFICATION BENEFITS

A

Awareness among employees and customers of in the organization’s commitment to protect the information

Identification of critical information

Identification of vulnerabilities to modification - enable focus on integrity controls

Sensitivity to the need to protect valuable information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ASSETS MANAGEMENT TERMS

A 
DATA SUBJECT
DATA OWNER
DATA CUSTODIAN
DATA STEWARD
PERSONAL DATA
PROCESSING
DATA CONTROLLER
DATA PROCESSOR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DATA OWNERSHIP

A

Accountable for important information security activities surrounding the life-cycle of information to:

Protect it

Ensure it is available to only those who require access

Destroy it when it is no longer needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

INFORMATION OWNER

A

Have broader responsibilities than Data Owners

Responsibilities:

Determine the impact the information has on mission

Understand the replacement cost of the information

Know when the information is no longer accurate, needed , or should be destroyed

Determine who has a need for the information and under what circumstances it should be released

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

DATA CUSTODIAN

A

Deals with consequences of the use of the data and responsible for integrity

Adherence to appropriate and relevant data policies, and procedures, baselines and guidelines

Ensuring accessibility to appropriate users, maintaining appropriate levels of security

Fundamental data maintenance, including but not limited to data storage and archiving

Data documentation, including updates to documentation

Assurance of quality and validation of any additions to data, including supporting periodic audits to ensure ongoing data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

DATA PROTECTION BY ROLE

A

DATA OWNER - Accountable

DATA CONTROLLER - Accountable

DATA CUSTODIAN - Responsible

DATA STEWARD - Responsible

DATA PROCESSOR - Responsible

DATA SUBJECT - Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SOUND RECORD RETENTION POLICY

A

Train staff

Audit retention and destruction practices

Periodically review policy

Document policy, implementation, training and audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

RECORD RETENTION HINTS

A

Information and data should only be kept as long as it is required (preferably legally required)

Keeping data longer than needed keeps RISK longer than needed

Data is a “snapshot” of information, which si always changing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ASSET RETENTION BEST PRACTICES

A

Promote cross-functional ownership

Promote cross-functional ownership for archiving, retention, and disposal policies

Plan and practice data retention and orderly disposal

Key areas of focus: media, hardware and personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

EXAMPLES OF DATA RETENTION POLICIES

A

European Document retention Guide 2013

State of Florida Electronic Records and Records Management Practices, November 2010

The Employment Practices Code, Information Commissioner’s Office, UK, November 2011

Wesleyan University, Information Technology Services Policy Regarding Data Retention for ITS-Owned Systems, September 2013

Visteon Corporation, International Data Protection Policy, April 2013

Texas State Records Retention Schedule (Revised 4th Edition)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

ESTABLISHING INFORMATION GOVERNANCE AND RETENTION POLICIES

A

Understand where the data is

Classify and define data

Archive and manage data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

EFFECTIVE ARCHIVING AND DATA RETENTION POLICIES

A

INVOLVE ALL STAKEHOLDERS

ESTABLISH COMMON OBJECTIVES FOR SUPPORTING ARCHIVING AND DATA RETENTION BEST PRACTICES WITHIN THE ORGANIZATION

MONITOR, REVIEW, AND UPDATE DOCUMENTED DATA RETENTION POLICIES AND ARCHIVING PROCEDURES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

SOUND RECORD RETENTION POLICY

A

EVALUATE STATUTORY REQUIREMENTS, LITIGATION OBLIGATIONS AND BUSINESS NEEDS

CLASSIFY TYPES OF RECORDS

DETERMINE RETENTION PERIODS AND DESTRUCTION PRACTICES

DRAFT AND JUSTIFY RECORD RETENTION POLICY

TRAIN STAFF

AUDIT RETENTION AND DESTRUCTION PRACTICES

PERIODICALLY REVIEW POLICY

DOCUMENT POLICY, IMPLEMENTATION, TRAINING AND AUDITS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

DATA QUALITY

A

DATA CAPTURE AND RECORDING AT THE TIME OF GATHERING

DATA MANIPULATION PRIOR TO DIGITIZATION

IDENTIFICATION OF THE COLLECTION AND ITS RECORDING

DIGITIZATION OF THE DATA

DOCUMENTATION OF THE DATA

DATA STORAGE AND ARCHIVING

DATA PRESENTATION AND DISSEMINATION

USING THE DATA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

DATA QUALITY STANDARDS

A

ACCURACY

PRECISION

RESOLUTION

RELIABILITY

REPEATABILITY

REPRODUCIBILITY

CURRENCY

RELEVANCE

ABILITY TO AUDIT

COMPLETENESS

TIMELINESS

31
Q

Organization for Economic Co-Operation and Development (OECD)
PRIVACY GUIDELINES

A

Collection Limitation

Data Quality

Purpose Specification

Use Limitation

Security Safeguards

Openness

Individual Participation

Accountability

32
Q

COLLECTION LIMITATION PRINCIPLE

A

There should be limits on the collection of data

Should be obtained by lawful and fair means

With the knowledge and consent of the subject

33
Q

QUALITY CONTROL (QC)

A

An assessment of the quality based on INTERNAL standards, processes, and procedures established to control and monitor quality.

34
Q

QUALITY ASSURANCE (QA)

A

An assessment of quality based on standards EXTERNAL to the process and involves reviewing of the activities and quality control processes to ensure final products meet predetermined standards of quality.

35
Q

ASSESSING AND IMPROVING DATA QUALITY

A

DATA QUALITY

DATA VERIFICATION

PREVENTION

CORRECTION

36
Q

BASELINES

A

MINIMUM LEVEL OF PROTECTION THAT CAN BE USED AS A REFERENCE POINT.

37
Q

SCOPING

A

LIMITING THOSE GENERAL BASELINE RECOMMENDATIONS BY REMOVING THOSE THAT DON’T APPLY.

38
Q

TAILORING

A

ALTERING BASELINE RECOMMENDATIONS TO APPLY MORE SPECIFICALLY

SCOPING THE ASSESSMENT PROCEDURES TO MORE CLOSELY MATCH THE CHARACTERISTICS OF THE INFORMATION SYSTEM AND ITS ENVIRONMENT OF OPERATION.

39
Q

BASELINE CATALOGS

A

INTERNATIONAL AND NATIONAL STANDARDS ORGANIZATIONS

INDUSTRY STANDARDS OR RECOMMENDATIONS

OTHER COMPANIES IN SIMILAR SECTOR

40
Q

GENERALLY ACCEPTED PRINCIPLES

A

INFORMATION SYSTEM SECURITY OBJECTIVES

PREVENT, DETECT, RESPOND AND RECOVER

PROTECTION OF INFORMATION WHILE BEING PROCESSED, IN TRANSIT AND IN STORAGE

EXTERNAL SYSTEMS ARE ASSUMED TO BE INSECURE

RESILIENCE FOR CRITICAL INFORMATION SYSTEMS

AUDITABILITY AND ACCOUNTABILITY

41
Q

LIFE-CYCLE OF NORMAL SYSTEM OPERATION

A

PREVENT

DETECT

RESPOND

RECOVER

42
Q

WHERE TO PROTECT DATA

A

IN PROCESS

IN TRANSIT

IN STORAGE

43
Q

RESILIENCE

A

ABILITY TO RETURN TO A KNOWN SET OF NORMAL OPERATIONS - WHEN ABNORMAL OPERATIONS ARE DETECTED.

44
Q

CSIS 20 CRITICAL SECURITY CONTROLS INITIATIVE

A

OFFENSE INFORMS DEFENSE

PRIORITIZATION

METRICS

CONTINUOUS MONITORING

AUTOMATION

45
Q

NIST SECURITY CONTENT AUTOMATION PROTOCOL (SCAP)

A

SUITE OF SPECIFICATIONS

MULTI-PURPOSE FRAMEWORK OF SPECIFICATIONS

46
Q

SCAP VERSION 1.2 CATEGORIES

A

LANGUAGES

REPORTING FORMATS

ENUMERATIONS

MEASUREMENT AND SCORING SYSTEMS

INTEGRITY

47
Q

FRAMEWORK CORE COMPONENTS

A

FRAMEWORK CORE IS A SET OF CYBER-SECURITY ACTIVITIES, DESIRED OUTCOMES, AND APPLICABLE REFERENCES THAT ARE COMMON ACROSS CRITICAL INFRASTRUCTURE SECTORS.

FRAMEWORK IMPLEMENTATION TIERS

FRAMEWORK PROFILE

48
Q

DATA STATES

A

DATA AT REST

DATA IN MOTION

DATA IN USE

49
Q

DATA AT REST

A

BACKUP DATA

OFFSITE STORAGE

PASSWORD FILES

OTHER SENSITIVE INFORMATION

USUALLY PROTECTED VIA CRYPTOGRAPHIC ALGOS

50
Q

DATA AT REST RECOMMANDATIONS

A

IMPLEMENT CONTROLS SUCH AS ENCRYPTION, ACCESS CONTROL AND REDUNDANCY

DEVELOP AND TEST AN APPROPRIATE DATA RECOVERY PLAN

USE COMPLAINT ENCRYPTION ALGOS

WHENEVER POSSIBLE USE AES FOR ENCRYPTION ALGOS DUE TO SPEED AND STRENGTH

FOLLOW STRONG PASSWORD REQUIREMENTS

DO NOT USE THE SAME PASSWORD FROM OTHER SYSTEMS

USE SECURE PASSWORD MANAGEMENT TOOLS TO STORE SENSITIVE INFORMATION SUCH AS PASSWORDS AND KEYS

SEND PASSWORDS SEPARATELY FROM ENCRYPTED FILE

DO NOT WRITE DOWN PASSWORD AND DO NOT STORE AT SAME LOCATION AS STORAGE MEDIA

VERIFY THAT REMOVABLE MEDIA WORKS USING DECRYPTION

DELETE USING DELETION GUIDELINES

REMOVABLE MEDIA SHOULD BE LABELED WITH TITLE, DATA OWNER AND ENCRYPTION DATE

51
Q

DATA IN TRANSIT PROTECTIONS

A

PREVENT THE CONTENTS OF THE MESSAGE FROM BEING REVEALED EVEN IF THE MESSAGE WAS

INTERCEPTED OR IN TRANSIT (EMAIL)

52
Q

DATA IN TRANSIT

A

DATA THAT MOVES - USUALLY ACROSS NETWORKS IS IN MOTION OR IN TRANSIT

53
Q

LINK ENCRYPTION

A

ENCRYPTS ALL DATA ALONG A COMMUNICATIONS PATH - USUALLY DONE BY SERVICE PROVIDERS

54
Q

END-TO-END ENCRYPTION

A

DATA IS ENCRYPTED AT START OF TRANSMISSION AND ONLY DECRYPTED AT THE REMOTE END

ROUTING INFORMATION REMAINS VISIBLE

55
Q

DATA IN USE

A

DATA BEING PROCESSED

NEEDS TO BE PROTECTED BY SECURE ENCLAVES (LAYERS OR VIRTUAL MACHINES)

56
Q

ENCLAVE

A

TERRITORY THAT IS ISOLATED OR DISTINCT FROM ANOTHER TERRITORY.

57
Q

INSECURE AND SECURE PROTOCOLS

A

TYPE INSECURE SECURE

Web Access HTTP HTTPS
File Transfer FTP, RCP FTPS, SFTP, SCP
Remote Shell telnet SSH v3
Remote Desktop VNC radmin, RDP

58
Q

PICKING ENCRYPTION ALGOS

A

The longer the key the better with complex passwords

59
Q

PICKING WIRELESS ENCRYPTION PROTOCOLS

A

ONLY STRONG ALGOS LIKE WPA2

60
Q

MEDIA

A

Media with sensitive information requires physical and logical controls

Media lacks means for digital accountability when the data is not encrypted

Extensive care must be taken when handling sensitive media

ENCRYPTION DOESN’T ENSURE ACCOUNTABILITY

61
Q

MARKING

A

Storage media must have:

Physical Label with sensitivity contained

Label should reflect if data is encrypted

Label may contain point of contact and retention period

When media is found without label it should be labeled at the highest sensitivity until identified

62
Q

HANDLING

A

Only designated personnel with sensitive media

Policies and procedures regarding proper handling of sensitive media should be communicated

Individuals handling the media should be trained on policies and procedures

63
Q

STORING

A

Sensitive media should not be left lying around where a passerby could access it

Wherever possible backup media should be encrypted and stored in a container

64
Q

DESTRUCTION

A

Media that is no longer needed or is defective should be defensively destroyed rather than simply disposed of.

65
Q

RECORD OF RETENTION

A

Information and data should only be kept as long as it’s required

Ensure that:

The organization understands the retention requirements for different types of data in the organization

The organization documents in a record’s schedule the retention requirements for each type of information

The systems, processes and individuals of the organization retain information in accordance with the schedule but no longer

66
Q

DATA REMANENCE

A

The residual physical representation of the data that has been in some way erased

After media is erased there may be some physical characteristics that allow data to be reconstructed

67
Q

DATA REMANENCE COUNTERMEASURES

A

Clearing

Purging

Destruction

68
Q

CLEARING

A

The removal of sensitive data from storage devices so there is assurance that the data may not be reconstructed using normal system function or software file/data recovery utilities

The data may still be recoverable - but not without special laboratory techniques

69
Q

PURGING

A

The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique

70
Q

DESTRUCTION

A

The storage media is made unusable for conventional equipment

Effectiveness of destroying the media varies

Destruction using appropriate techniques is the most secure method of preventing retrieval and referred to as “defensible destruction”

71
Q

DATA DESTRUCTION METHODS

A

OVERWRITING

DEGAUSSING

ENCRYPTION

72
Q

DEFENSIBLE DESTRUCTION

A

Physically breaking the media apart

Chemically altering the media into non-readable, non-reverse-constructible state

Phase transition

For magnetic media, raising its temperature above the Curie Temperature

73
Q

SOLID-STATE DRIVE (SSD) DESTRUCTION

A

SSD’s use flash memory for data storage and retrieval

Flash memory differs from magnetic memory in one key way: flash memory cannot be overwritten

Unlike HDD’s - overwriting is not effective for SSD’s

Cryptographic erasure, or crypto-erase, takes advantage of the SSD’s built-in data encryption

The best type of data destruction method is a combination of crypto-erase, sanitization, and targeted overwrite passes

74
Q

CLOUD-BASED DATA REMANENCE

A

Little to no visibility in to the management and security of the data in many cases

PaaS-based architecture can actually provide a solution for the issues raised by the data remanence in the cloud

Crypto-Erase/Crypto Shredding can work

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions