Chapter 2: Asset Security Flashcards
Senior/Exec Management
CEO, CFO, CIO, ISO - infosec officer`
Steering Committee
Define Risks, Objectives and Approaches.
Auditors
Evaluates Business Processes
testable should answer to an independent enity in org such as the CEO have them aligned with him.
Data Owner
Classifies Data - determines the classification of data
Data Custodian
Day to day maintenance of data
Network Admin
Ensures Availability of network resources
not to be security admin need to be different.
Security Administrator
Responsible for all security-related tasks, focusing on Confidentiality and Integrity.
can’t be network admin…
Information Security Officer - ISO
responsible for providing CIA for all assets communicates risks to senior management recommends best practices establish security measurements compliance with gov and industries awareness of emerging threats
the C’s of Classification
Cost - value of data
classify - criteria for classification
controls - determines baseline security config for each
what is purpose of classification?
to drive what controls needs to be in place to protect he info
consideration for asset value
value to org
loss if compromised
legislative drivers
liabilities
sensitivity
describes the amount of damage that would be done should the info be disclosed
criticality
describes the time sensitivity of the data. how much revenue will be lost when something is down.
3 states of data
at rest - File system encryptions, efs, tpm
in process -
in transit
EFS
windows encryption might be vurnerable because you can put drive in different type of computer.
TPM
trusted platform module. encryption is on the key on the motherboard. if hard drive is stolen… - PGP is one etc.
data in process
screen protectors…physical secuirty
data in transit
use secure protocols - tls, ssl, ipsec
System Hardening
remove unnecessary services
installing latest service packs and patches
rename default accts
change default settings
enabling security configs like auditing, firewalls, updates etc.
don’t forget physical security.
Config Management
Defined by ISC2 as “ a process of id’ing and documenting hardware components, software and the associated settings”
controlling changes made to servers and documenting it…
TCB
Trusted computing base
Change Management
Admin control policy - should be incorporated into org. policy.
only approved changes will be implemented.
ultimate goal is system stability.
DON’T FIX PROBLEMS
do not make changes…
change management process
request submittal risk assessment approval or rejection testing scheduling implementaion validation documentation
patch management
a process to prioritze patches …etc. below change management…
