Chapter 2: Asset Security Flashcards
Senior/Exec Management
CEO, CFO, CIO, ISO - infosec officer`
Steering Committee
Define Risks, Objectives and Approaches.
Auditors
Evaluates Business Processes
testable should answer to an independent enity in org such as the CEO have them aligned with him.
Data Owner
Classifies Data - determines the classification of data
Data Custodian
Day to day maintenance of data
Network Admin
Ensures Availability of network resources
not to be security admin need to be different.
Security Administrator
Responsible for all security-related tasks, focusing on Confidentiality and Integrity.
can’t be network admin…
Information Security Officer - ISO
responsible for providing CIA for all assets communicates risks to senior management recommends best practices establish security measurements compliance with gov and industries awareness of emerging threats
the C’s of Classification
Cost - value of data
classify - criteria for classification
controls - determines baseline security config for each
what is purpose of classification?
to drive what controls needs to be in place to protect he info
consideration for asset value
value to org
loss if compromised
legislative drivers
liabilities
sensitivity
describes the amount of damage that would be done should the info be disclosed
criticality
describes the time sensitivity of the data. how much revenue will be lost when something is down.
3 states of data
at rest - File system encryptions, efs, tpm
in process -
in transit
EFS
windows encryption might be vurnerable because you can put drive in different type of computer.
