Chapter 5 Protecting Security of Assets Flashcards
“applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the original classification authority is able to identify or describe.”
Top Secret
Secret
Confidential
Unclassified
Secret
available to anyone, though it often requires individuals to request the information using procedures identified in the Freedom of Information Act (FOIA).
Top Secret
Secret
Confidential
Unclassified
Unclassified
“applied to information, the unauthorized t disclosure of
which reasonably could be expected to cause exceptionally grave damage to the national security that the original classification authority is able to identify or describe.”
Top Secret
Secret
Confidential
Unclassified
Top Secret
“applied to information, the unauthorized disclosure
of which reasonably could be expected to cause damage to the national security that the original classification authority is able to identify or describe.”
Top Secret
Secret
Confidential
Unclassified
Confidential
information posted in websites, brochures, or any other public source.
Confidential or Proprietary
Private
Sensitive
Public
Public
a data breach would cause serious damage to the mission of the organization.
Confidential or Proprietary
Private
Sensitive
Public
Private
a data breach would cause exceptionally grave damage
to the mission of the organization.
Confidential or Proprietary
Private
Sensitive
Public
Confidential or Proprietary
a data breach
would cause damage to the mission of the organization.
Confidential or Proprietary
Private
Sensitive
Public
Sensitive
________ is the data that remains on a hard drive as residual magnetic flux.
Data remanence
What realigns the magnetic fields in magnetic media such as traditional hard drives, magnetic tape, and floppy disk drives.
Degausser
any process that purges media or a system in
preparation for reuse in an unclassified environment
Erasing Clearing Purging Declassification Sanitization Degaussing
Declassification
combination of processes that removes data from a system or from media. It ensures that data cannot be recovered by any means.
Erasing Clearing Purging Declassification Sanitization Degaussing
Sanitization
creates a strong magnetic field that erases data on some media and used to remove data
from magnetic tapes
Erasing Clearing Purging Declassification Sanitization Degaussing
Degaussing
writes a single character over the entire media, writes the character’s complement over the entire media, and finishes by writing random bits over the entire media. It repeats this in three separate passes,
Erasing Clearing Purging Declassification Sanitization Degaussing
Clearing
clearing that prepares media for reuse in less secure environments. Repeats the clearing process multiple
times and may combine it with another method
Erasing Clearing Purging Declassification Sanitization Degaussing
Purging
It can use key sizes of 32 bits to 448 bits and is a strong encryption protocol.
Advanced Encryption Standard
Triple DES
Blowfish
Blowfish
NIST selected it as a standard replacement
for the older Data Encryption Standard (DES) in 2001
Advanced Encryption Standard
Triple DES
Blowfish
Advanced Encryption Standard
The fi rst implementation used 56-bit keys but newer implementations use 112-bit or 168-bit
keys.
Advanced Encryption Standard
Triple DES
Blowfish
Triple DES
Almost all HTTPS transmissions use ____ as the underlying encryption protocol
Transport Layer Security (TLS)
L2TP/IPsec encrypts data and sends it over the Internet using _________
mode to protect it while in transit.
Tunnel
_____ assign permissions based on the principles of least privilege and the need to know, granting users access to only what they need for their job.
Data Owners System Owners Business/Mission Owners Data Processors Administrators Custodians
Administrators
______ helps protect the
integrity and security of data by ensuring it is properly stored and protected.
Data Owners System Owners Business/Mission Owners Data Processors Administrators Custodians
Custodians
“a natural or legal person which processes personal data solely on behalf of the data controller.”
Data Owners Data Processors Business/Mission Owners Data Processors Administrators Custodians
Data Processors
They also ensure it has adequate security controls based on the classification and the organization’s security policy
requirements.
Data Owners System Owners Business/Mission Owners Data Processors Administrators Custodians
Data Owners
Maintains the system security plan and ensures that the system is deployed and operated according to the agreed-upon security requirements
Data Owners System Owners Business/Mission Owners Data Processors Administrators Custodians
System Owners
The US Department of Commerce runs the ______
program, which is a regulatory mechanism that includes a set of Safe Harbor
Principles.
Safe Harbor
Degaussing does not affect optical \_\_\_\_\_ CDs DVDs hard disks magnetic tapes SSDs.
CDs, DVDs, or SSDs.
_______ is a delete operation against a file, a selection of files, or the entire media.
Erasing Clearing Purging Declassification Sanitization Degaussing
Erasing
__________ is a process of preparing media for reuse and assuring that the cleared data cannot be recovered using traditional recovery tools.
Erasing Clearing Purging Declassification Sanitization Degaussing
Clearing
IPsec is often combined with ______ for VPNs.
Layer 2 Tunneling Protocol (L2TP)
________ identify the classification of data and ensure that it is labeled properly.
Data Owners System Owners Business/Mission Owners Data Processors Administrators Custodians
Data Owners
Establishes the rules for appropriate use and protection of the subject
data/information (rules of behavior)
Provides input to information system owners regarding the security requirements
and security controls for the information system(s) where the information resides
Decides who has access to the information system and with what types of privileges
or access rights
Data Owners System Owners Business/Mission Owners Data Processors Administrators Custodians
Data Owners
Develops a system security plan in coordination with information owners, the system administrator, and functional end users
Maintains the system security plan and ensures that the system is deployed and
operated according to the agreed-upon security requirements
Ensures that system users and support personnel receive appropriate security
training, such as instruction on rules of behavior (or an AUP)
Updates the system security plan whenever a significant change occurs
Assists in the identification, implementation, and assessment of the common security controls.
Data Owners System Owners Business/Mission Owners Data Processors Administrators Custodians
System Owners
