Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Certified Information Systems Security Professional > D2. Asset Security > Flashcards

D2. Asset Security Flashcards

1
Q

This is a critical first step toward ensuring the security of your systems and data.

A

Identifying and classifying information assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

These are the foundational steps in establishing an information security asset management program.

A
  1. Creating an inventory of what assets an organization has
  2. Where the assets are located?
  3. Who is responsible for the assets?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Is the process of organizing data into groups or categories that describe the data’s sensitivity, criticality, and value.

A

What is data classification?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A cornerstone of data security and risk management, this helps to determine the security controls necessary to manage and safeguard the confidentiality, integrity, and availability of data.

A

What is data classification?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the three (3) primary steps of data classification?

A
  1. Context-based
  2. Content-based
  3. User-based
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Derived from metadata like ownership, location, or other values that can indirectly indicate sensitivity or criticality.

A

What is context-based?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Derived by inspecting the contents of files and directly identifying sensitive data, rather than inferring it from metadata.

A

What is content-based?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Involves manual assignment of data classification and is based on user’s understanding of the data and your organization’ classification scheme.

A

What is user-based?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Generally considered the highest level of classification outside of government or military organizations. The loss of this data can cause serious risk to the organization.

A

What is confidential classification scheme?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Losing this data will raise the risk to the organization, even if it is just repetitional damage (strategy documents or inter organizational correspondence can be considered sensitive).

A

What is sensitive classification scheme?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Usually compartmental data that might not do the company damage but must be kept private for other reasons (employee renting statistics and salary ranges).

A

What is private classification scheme?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data that is disclosed outside the company on a limited basis or contains information that could reduce the company’s competitive advantage, such as technical specification of a new product.

A

What is proprietary classification scheme?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Data that if lost would have little or no impact to the company.

A

What is public classification scheme?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Other labels used to designate documents (but not considered classifications).

A

For Official Use Only (FOUO) and Limited Official Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Is the process of grouping types of data with comparable sensitivity labels.

A

What is data categorization?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Identifying the sensitivity, criticality, and value of the information systems and assets that store, process, and transmit that data, as well as the data itself.

A

What is asset classification?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Involves grouping assets based on their relative level of sensitivity and the impact to the organization should the assets be compromised.

A

What is asset classification?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the major benefits of classification?

A
  1. Accurate asset inventory
  2. Insight into the environment
  3. Optimize change, vulnerability, and management programs
  4. Maintenance windows
  5. Security controls and segmentation
  6. Protection of sensitive data
  7. Identify rouge assets
  8. Understand potential risks posed by vulnerabilities
  9. Identify proprietary assets and intellectual property
  10. Forecast cost
  11. Compliance and Regulation controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Assets should be identified and controlled based on their level of.

A

What is sensitivity?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

While data classification is the most important element on a data label, asset labels may contain other information, such as.

A
  1. Title of the asset
  2. Data owner
  3. Data retention period (if applicable)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

This helps keep asset handling efficient and cost-effective.

A

What is marketing and labeling of public data or unclassified information?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

This aids by using digital marketing to identify and prevent sensitive information from leaking out of an organization.

A

What is Data Loss Prevention (DLP)?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

These are critical to your organization’s overall asset security management.

A

What are handling and storage guidelines?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the consideration to data storage?

A
  1. Encryption
  2. Limiting the volume of data retained
  3. Backups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The process of modifying the assigned classification of an asset to a lower level of sensitivity.

A

What is declassification?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Methods to declassify assets include.

A

What is de-identification and tokenization?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

The process of removing information that can be used to identify an individual (PII).

A

What is Data de-identification?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The data de-identification process involves taking any personally identifying data fields and converting them to.

A

What is masked, obfuscated, encrypted, or tokenized data fields?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Is the process of substituting a sensitive data element with a nonsensitive set of characters or numbers called a token.

A

What is tokenization?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

This is the source to trust, if there is a conflict between what the tools are reporting, and also the source used for official reports and other data requests, such as part of an audit.

A

What is the system of record?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What the components of a typical asset management lifecycle?

A
  1. Strategy
  2. Plan
  3. Design
  4. Procure
  5. Operate
  6. Maintain
  7. Modify
  8. Dispose
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Activities critical to implementing a formal asset management program include.

A
  1. Assignment of ownership
  2. IT asset management
  3. Configuration management
  4. Change management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Is a set of business practices related to governing and maintaining IT assets, including hardware, software, data, and related processes.

A

What is Information technology asset management (ITAM)?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

The International Standards Organization (ISO) has established this official set of standards related to ITAM.

A

What is the ISO 19770 family of standards?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

The ISO 19770 family of standards consist of

A

ISO/IEC 19770-1: Best practices and demonstrate compliance
ISO/IEC 19770-2: Software identification (SWID)
ISO/IEC 19770-3: Common terminology for describing software entitlement rights, limitations, and metrics
ISO/IEC 19770-4: Standardize reporting of resource utilization
ISO/IEC 19770-5: overview of ITAM and defines volcabulary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Relates to asset management and asset security, this keeping inventory current, system and software configurations must be controlled and documented

A

What is configuration management?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Identifies the version and settings of all configuration items (CI) in a product, system, or subsystem; and answers the question ‘what do I need to build the system correctly?’

A

What is a system baseline?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Is a minimum set of safeguards required to protect a given system.

A

What is a security baseline?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

This enables validate security products to automatically perform configuration checking using NCP checklists.

A

What is Security Content Automation Protocol (SCAP)?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

An IT discipline focused on ensuring that organizations employ standard processes to make changes to their assets, and prevent arbitrary and unexpected modifications to their hardware and software inventory.

A

What is Change management?

41
Q

What are the stages of the data lifecycle?

A
  1. Collect
  2. Store
  3. Use
  4. Share
  5. Retain
  6. Destroy
42
Q

This is when data is generated or aggregated?

A

What is collect?

43
Q

Term used when data is saved into a storage system or repository.

A

What is store?

44
Q

Term used data is processed and/or analyzed, by users or systems, for its intended purpose.

A

What is use?

45
Q

Term used when data is shared with authorized external users and systems.

A

What is shared?

46
Q

Term used when data is kept (archived) for a predefined period of time.

A

What is retain?

47
Q

Term used when data is deleted and permanently removed from storage, making it inaccessible and unusable.

A

What is destroy?

48
Q

A high-level process that describes how data can flow through an organization.

A

What is data lifecycle?

49
Q

This is an individual or group of individuals responsible for dictating how and why data should be used, as well as determining how the data must be secured.

A

What are data owners?

50
Q

Data owners (information owner/steward) have complete control over information and can/be

A
  1. Responsible and accountable for their data
  2. Held liable for negligence
  3. by the organizations data policy, authorize to use, collect, share, and store
  4. set access protection rules
  5. in collaboration with information system owners, determine security controls for access and use in the system
51
Q

Using reasonable measures and efforts to protect assets deemed valuable or assigned sensitivity levels, is referred to as?

A

What is due care?

52
Q

Term used to describe taking all expectable or practical steps to maintain due care, including verifying that everything is being done as intended by due care.

A

What is due diligence?

53
Q

This is the person, agency, company, or other body that, alone or jointly with others, determines the purpose and means of data processing.

A

What is the data controller?

54
Q

Data controllers negotiate privacy protections for personal data with data processors via secure contractural terms and assurances, called

A

What is a data processing agreement?

55
Q

Is responsible for maintaining data on the IT infrastructure, in accordance with requirements established by the data owner and the business.

A

What is a data custodian?

56
Q

Party responsible for transferring, transmitting, or otherwise handling data on behalf of a data owner is?

A

What is a data processor?

57
Q

The data processor performs data manipulation on behalf of this role.

A

What is data controller?

58
Q

This is the customer or intended recipient of data. The party who consumes that data.

A

What is users?

59
Q

Identified or identifiable natural people from whom or about whom information is collected.

A

What is data subjects?

60
Q

Notifying a user how the information collected will be used (consent), and about a nation’s citizen or residents must be deleted from foreign systems before being removed from systems in the data subjects’s nation, is referred to as.

A

What is data location?

61
Q

What are the six steps of the data lifecycle?

A
  1. (Consent) - collect
  2. Store
  3. Use
  4. Share
  5. Retain
  6. Destroy
62
Q

This involves all manner of processing, analyzing, and sharing data.

A

What is use?

63
Q

Process of continuously monitoring your data and applying principles like least privilege and defense in depth.

A

What is data maintenance?

64
Q

Term used to regarding considerations made for how long data will be retained before being securely destroyed.

A

What is data retention?

65
Q

Final stage of the data lifecycle, often neglected, by regulation or for functionality, this term refers to the process to remove data.

A

What is data destruction?

66
Q

This occurs when data destruction efforts were insufficient to prevent the reconstruction of the data.

A

What is data remanence?

67
Q

This is when the data is no longer needed and they key is deleted, the data is rendered unusable or unreachable.

A

What is cryptographic erasure?

68
Q

This is the guideline for media sanitization

A

What is NIST SP 800-88?

69
Q

To achieve a level of assurance of adequate asset sanitization, the following techniques can be used:

A
  1. Cleansing (digitally wiping data)
  2. Purging (degaussing)
  3. Destruction (shredding, burning, or pulverizing)
70
Q

You would used these requirements for specific techniques to achieve the desired level of assurance in sanitization

A
  1. Zeroing (erase and overwrite with zeros)
  2. Overwriting (random passes of 0 and 1 combinations to overwrite previous data)
  3. Degaussing (magnetic media is erased)
71
Q

This article is commonly referred to as the right to be forgotten

A

What is EU GDPR’s Article 17 - The Right to Erasure

72
Q

Security controls are based on these:

A
  1. Classification of the asset
  2. Data state
  3. compliance requirements
  4. Industry standards
73
Q

What are the three categories of control?

A

What are technical controls, administrative controls, and physical controls?

74
Q

Security controls (technical, administrative, and physical) have applicable types of controls described as?

A
  1. Deterrent
  2. Preventative
  3. Detective
  4. Corrective
  5. Recovery
75
Q

These are examples of data states

A
  1. At rest
  2. in motion
  3. In use
76
Q

Data that is stored on a system and not actively being written to, read from, transmitted, or otherwise processed.

A

What is data at rest?

77
Q

This is a common form of security control for data at rest, and can be employed across an entire volume of storage

A

What is full-disk encryption?

78
Q

This is a microcontroller chip integrated into the computer hardware that provides a crypto processor

A

What is Trusted Platform Module (TPM)?

79
Q

This is a hard disk drive or solid state drive that automatically encrypts and decrypts drive data without the need for additional encryption software

A

What is self-encrypting drive (SED)?

80
Q

This refers to data that is actively being transmitted across a network, between multiple networks, or from one location to another. Also described as data in motion.

A

What is data in transit?

81
Q

These technologies help secure data in transit

A

What are transport layer security, HTTPS, and virtual private networks (VPN)?

82
Q

This method of data-in-transit security where the traffic is encrypted and decrypted at each network routing point

A

What is link encryption?

83
Q

This type of system of communication ensures that only the sender and recipient can read the data

A

What is End-to end encryption?

84
Q

This term refers to data that is actively being processed by an application being used by a user

A

What is data in use?

85
Q

Establishing a baseline of security controls begins with.

A

What is the scoping and tailoring process?

86
Q

Is the process the organization undertakes to consider which security controls apply and what assets they need to protect.

A

What is scoping?

87
Q

Is the process of modifying the set of controls to meet the specific characteristics and requirements of the organization.

A

What is tailoring?

88
Q

This control augments a primary control’s ability to achieve a control objective or replace the primary control to meet the given control objective

A

What are compensating controls?

89
Q

The minimum set of security controls that are required is referred to as

A

What is security baseline?

90
Q

These controls are based on specific threats or regulatory requirements of an organization or an industry

A

What are supplemental controls?

91
Q

A collection of documented policies and procedures that define how to mange an enterprises’ security

A

What is a security framework?

92
Q

Is a set of tools and processes focused on controlling the use, modification, and distribution of intellectual property (IP) throughout its life-cycle.

A

What is digital rights management (DRM)?

93
Q

Is a related technology that more broadly protects data from unauthorized access by controlling who can view, copy, delete, or otherwise modify data.

A

What is information rights management (IRM)?

94
Q

Sometimes referred to as data leakage prevention, is the set of technologies and practices used to ensure that sensitive data is not lost or accessed by unauthorized parties.

A

What is Data Loss Prevention (DLP)?

95
Q

Data Loss Prevention consists of these three core stages

A
  1. Discovery (finding all instances of data) and classification (act of categorizing that data based on its sensitivity and value)
  2. Monitoring (inspecting data as it moves throughout the life-cycle)
  3. Enforcement (actions taken to prevent policy violations identified during the monitoring stage)
96
Q

This is a software application that sits between cloud users and cloud services and applications; actively monitors all cloud activity and implement centralized controls to enforce security.

A

What is Cloud Access Security Broker (CASB)?

97
Q

CASB aims to serve these four primary functions:

A
  1. Visibility
  2. Data security
  3. Threat protection
  4. Compliance
98
Q

What are the three primary types of CASB solutions?

A
  1. Forward proxy
  2. Reverse proxy
  3. API-based

Certified Information Systems Security Professional (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions