Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Work > Chap 2 - Information asset security > Flashcards

Chap 2 - Information asset security Flashcards

1
Q

what are assets

A
  • people
  • process / know-how
  • facilities
  • equipment
  • retained knowledge
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

tangible assets

A

physical existence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

intangible assets

A

exist in mind (e.g., brand)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IT asset mgmt lifecycle

A
  1. plan
  2. assign security needs
  3. acquire
  4. deploy
  5. manage
  6. retire
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

how to assign security needs to asset

A

either qualitative or quantitative.
the security needs first looks at classifying & categorizing the asset based on HARM to organization if hit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is asset classification

A

process of recognizing the impact of asset if compromise based on CIA triad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is asset categorization

A

process of grouping sets of data, information, knowledge that have comparable sensitivity –> similar security needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what should classification/categorization policy include

A
  1. data classification/categorization -> criteria & process
  2. data access -> define role of subject who can access data
  3. data security -> generally available or restricted data by default
  4. data retention -> data retained for period of time (e.g., law -> telcos)
  5. data disposal -> printed VS digital
  6. data encryption -> if need to be encrypted and how
  7. appropriate use of data -> how to use the data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what are data sensitivity levels (classic)

A
  1. highly restricted
  2. moderately restricted
  3. low sensitivity / internal use
  4. unrestricted/ public
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what are key issues related to classification & categorization

A
  1. responsibility
  2. accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what is the data security lifecycle

A
  1. creating
  2. storing
  3. using
  4. sharing
  5. archiving
  6. disposing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what are the key data roles (people)

A
  1. data subject -> individual who describe/identify by data
  2. data owner -> accountable for determining the value of the data
  3. data controller -> in absence of controller, he is accountable
  4. data steward -> responsible for the data content
  5. data processor -> entities that process data on behalf of controller
  6. data custodian -> responsible for the protection of the data (security)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what are the key data states

A
  1. data at rest
  2. data in motion (transit)
  3. data in use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is the data lifecycle considerations

A
  1. data collection
  2. data location
  3. data maintenance
  4. data retention
  5. data remanence -> use e.g., CPU
  6. data destruction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are the 3 ways for data destruction

A
  1. clearing -> overwrite data with random values also called “clobbering” or “zeroizing”
  2. Purging -> perform a delete operation - NOTE data may be recoverable
  3. physical destruction -> e.g. shred/destruct physically
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Main applicable type of controls for data security

A
  1. administrative controls -> policies & procedures
  2. technical/logical controls -> tech solutions
  3. physical controls -> tangible mechanism e.g, fence/guards/lock…
17
Q

Security controls categories

A
  1. directive controls -> policies & rules
  2. deterrent controls -> reduce likelihood of unwanted activity
  3. preventive control -> prevent activity from happening
  4. compensating controls -> mitigate the effect of unwanted activity
  5. detective control -> recognize or discover hostile activities
  6. corrective controls -> react to situation to remedy/restore operations
  7. recovery controls -> restore operations
18
Q

why establishing a data security baseline

A

security baseline is the minimum level of protection as a reference point -> minimum understood & acceptable level of security requirements

definition of the minimum level of protection that is required to protect valuable assets

19
Q

what are the security generally accepted principles

A
  1. info system security objectives
  2. prevent, detect, respond & recover
  3. protection of info while being processed, transit and stored
  4. external system assumed to be unsecured
  5. resilience for critical info system
  6. auditability and accountability
20
Q

what is the difference between security control scoping & tailoring

A

scoping: limiting the general baseline to remove inapplicable controls

tailoring: involves scoping to further match organization which gives the FLEXIBILITY needed to avoid COMPLEX & COSTY assessment while meeting requirements

21
Q

what is accountability

A

ensure the account mgmt has assurance that only authorized users have access & using properly

22
Q

what is data defensible destruction

A

eliminating data using a controlled, legally defensible and regulatory compliant way

23
Q

Angela is an information security architect at a bank and has been assigned to ensure that transactions are secure as they traverse the network. She recommends that all transactions use TLS. What threat is she most likely attempting to stop, and what method is she using to protect against it?

A

Sniffing, encryption

24
Q

What issue is common to spare sectors and bad sectors on hard drives as well as overprovisioned space on modern SSDs?

A

They may not be cleared, resulting in data remanence

25
Q

What technique could you use to mark your trade secret information in case it was released or stolen and you need to identify it?

A

Watermarks

26
Q

Chris is responsible for workstations throughout his company and knows that some of the company’s workstations are used to handle proprietary information. Which option best describes what should happen at the end of their lifecycle for workstations he is responsible for?

A

Sanitization

27
Q

How should you determine what controls from the baseline a given system or software package should receive?

A

Select based on the data classification of the data it stores or handles

28
Q

Fred’s organization allows downgrading of systems for reuse after projects have been finished and the systems have been purged. What concern should Fred raise about the reuse of the systems from his Top Secret classified project for a future project classified as Secret?

A

The cost of the sanitization process may exceed the cost of new equipment

29
Q

Which of the following is the least effective method of removing data from media?

A

Erasing

30
Q

what is erasing data

A

Erasing, which describes a typical deletion process in many operating systems, typically removes only the link to the file, and leaves the data that makes up the file itself

31
Q

what is degaussing

A

Degaussing works only on magnetic media, but it can be quite effective on it

32
Q

Chris is responsible for his organization’s security standards and has guided the selection and implementation of a security baseline for Windows PCs in his organization. How can Chris most effectively make sure that the workstations he is responsible for are being checked for compliance and that settings are being applied as necessary?

A

Use Microsoft Group Policy

33
Q

What primary issue does personnel retention deal with?

A

Knowledge gained during employment

34
Q

what is the difference between data clearing and data purging

A

Clearing: data removed, but fragments are recoverable

Purging: data removed, it is permanently gone –> degaussing is a form of purge

35
Q

Which of the following is not a part of the European Union’s Data Protection principles?

A

A. Notice
B. Reason -> correct
C. Security
D. Access

36
Q

Susan works in an organization that labels all removable media with the classification level of the data it contains, including public data. Why would Susan’s employer label all media instead of labelling only the media that contains data that could cause harm if it was exposed?

A

It prevents reuse of public media for sensitive data.

37
Q

Charles has been asked to downgrade the media used for storage of private data for his organization. What process should Charles follow?

A

Follow the organization’s purging process, and then downgrade and replace labels.

38
Q

Susan needs to provide a set of minimum security requirements for email. What steps should she recommend for her organization to ensure that the email remains secure?

A

Sensitive email should be encrypted and labelled.

39
Q

What is the most important aspect of marking media?

A

Classification

Work (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions