Chap 2 - Information asset security Flashcards
what are assets
- people
- process / know-how
- facilities
- equipment
- retained knowledge
tangible assets
physical existence
intangible assets
exist in mind (e.g., brand)
IT asset mgmt lifecycle
- plan
- assign security needs
- acquire
- deploy
- manage
- retire
how to assign security needs to asset
either qualitative or quantitative.
the security needs first looks at classifying & categorizing the asset based on HARM to organization if hit
what is asset classification
process of recognizing the impact of asset if compromise based on CIA triad
what is asset categorization
process of grouping sets of data, information, knowledge that have comparable sensitivity –> similar security needs
what should classification/categorization policy include
- data classification/categorization -> criteria & process
- data access -> define role of subject who can access data
- data security -> generally available or restricted data by default
- data retention -> data retained for period of time (e.g., law -> telcos)
- data disposal -> printed VS digital
- data encryption -> if need to be encrypted and how
- appropriate use of data -> how to use the data
what are data sensitivity levels (classic)
- highly restricted
- moderately restricted
- low sensitivity / internal use
- unrestricted/ public
what are key issues related to classification & categorization
- responsibility
- accountability
what is the data security lifecycle
- creating
- storing
- using
- sharing
- archiving
- disposing
what are the key data roles (people)
- data subject -> individual who describe/identify by data
- data owner -> accountable for determining the value of the data
- data controller -> in absence of controller, he is accountable
- data steward -> responsible for the data content
- data processor -> entities that process data on behalf of controller
- data custodian -> responsible for the protection of the data (security)
what are the key data states
- data at rest
- data in motion (transit)
- data in use
what is the data lifecycle considerations
- data collection
- data location
- data maintenance
- data retention
- data remanence -> use e.g., CPU
- data destruction
what are the 3 ways for data destruction
- clearing -> overwrite data with random values also called “clobbering” or “zeroizing”
- Purging -> perform a delete operation - NOTE data may be recoverable
- physical destruction -> e.g. shred/destruct physically
Main applicable type of controls for data security
- administrative controls -> policies & procedures
- technical/logical controls -> tech solutions
- physical controls -> tangible mechanism e.g, fence/guards/lock…
Security controls categories
- directive controls -> policies & rules
- deterrent controls -> reduce likelihood of unwanted activity
- preventive control -> prevent activity from happening
- compensating controls -> mitigate the effect of unwanted activity
- detective control -> recognize or discover hostile activities
- corrective controls -> react to situation to remedy/restore operations
- recovery controls -> restore operations
why establishing a data security baseline
security baseline is the minimum level of protection as a reference point -> minimum understood & acceptable level of security requirements
definition of the minimum level of protection that is required to protect valuable assets
what are the security generally accepted principles
- info system security objectives
- prevent, detect, respond & recover
- protection of info while being processed, transit and stored
- external system assumed to be unsecured
- resilience for critical info system
- auditability and accountability
what is the difference between security control scoping & tailoring
scoping: limiting the general baseline to remove inapplicable controls
tailoring: involves scoping to further match organization which gives the FLEXIBILITY needed to avoid COMPLEX & COSTY assessment while meeting requirements
what is accountability
ensure the account mgmt has assurance that only authorized users have access & using properly
what is data defensible destruction
eliminating data using a controlled, legally defensible and regulatory compliant way
Angela is an information security architect at a bank and has been assigned to ensure that transactions are secure as they traverse the network. She recommends that all transactions use TLS. What threat is she most likely attempting to stop, and what method is she using to protect against it?
Sniffing, encryption
What issue is common to spare sectors and bad sectors on hard drives as well as overprovisioned space on modern SSDs?
They may not be cleared, resulting in data remanence
