Data Security Concepts

Question 1

What is Information Classification?

Answer 1

The process by which organizations assess the information they hold and the level of protection it should be given based on the information’s risk to loss or harm from disclosure.

Question 2

What is Information Categorization?

Answer 2

Labelling information based on its type such as a specific category or other label defined by an organization.

Question 3

What is Security Category?

Answer 3

Categorization of information or information system based on potential impact of loss of confidentiality, integrity, and availability.

Question 4

What are the necessary steps to categorize information?

Answer 4

• Identify all information types of data (input, stored, processed, output)
• use defined criteria to assign levels of impact, assign system security category

Question 5

Which resources are available for classification and categorization?

Answer 5

• NIST SP 800-53 (to develop information classification and categorization systems)
• NIST SP 800-60 (to map security categories)
• ISO/IEC 27001 (Information security management)

Question 6

What is the most common option to protect data in transit?

Answer 6

Using encryption and keys

Question 7

What is an encryption key?

Answer 7

A piece of information in a digitized form used by an encryption algorithm to convert plaintext to cyphertext.

Question 8

What are the key characteristics of a symmetric key algorithm?

Answer 8

• Encryption using “shared secret” key
• Used to encrypt and decrypt
• Only addresses confidentiality

Question 9

What are the key characteristics of an asymmetric key algorithm?

Answer 9

• Encrypt using two keys: a public key shared with all users and a private key kept secret to user
• Keys used in tandem to encrypt/decrypt

Question 10

What are the key characteristics of a hash function?

Answer 10

• unique value derived from message
• message digest validates the message is not modified

Question 11

What is the key characteristics of Public Key Infrastructure?

Answer 11

• Infrastructure that enables users to exchange data securely in public spaces using private cryptographic key pair from trusted authority

Question 12

What is SSL?

Answer 12

Secure Socket Layers: a cryptographic protocol designed to provide authentication and data encryption.

Question 13

What is TLS?

Answer 13

Transport Layer Security: it replaces SSL. It provides communication privacy over the internet.

Question 14

What are the characteristics of Secure/Multipurpose Internet Mail Extensions (S/MIME)?

Answer 14

• Electronic messaging application security
• Authentication
• Message integrity
• Non-repudiation of origin
• Privacy
• Data security

Question 15

What are the five types of certificates for digital signatures and identification?

Answer 15

1) Client SSL certificate
2) Server SSL certificate
3) S/MIME certificate
4) Object-signing certificate
5) Certificate Authority (CA) certificate

Question 16

What are other additional options to provide the security of digital signatures and identification?

Answer 16

• Public key infrastructure (PKI)
• Certificate chain
• Digital signatures
• Non-repudiation