Domain 2 - Asset Security Flashcards
List Data Destruction Methods
Erasing: performing a delete operation against a file (data typically recoverable)
Clearing (overwriting): prepare media for reuse, ensuring data cannot be recovered using recovery tool, some bad sector on hard disk may contain data remanance
Purging: intense form of clearing, in less secure enviroment
but doesn’t prevent recovery completely
Degaussing: create strong magnetic field that erase data on media, doesn’t work on SSD
Declassification: Any process that purges media or a system to prepare it for use in an unclassified environment, more expensive than buy new media
Sanitization: Process of rendering target data on the media infeasible for a given level of recovery effort, should be enough
Destruction: The final stage in media, the most secure method, Shredding, Acid
Disintegration: SSD shredding process using approved hardware that reduces the drives to ultra-fine particles measuring no more than 4mm square
What is Record Retention policy?
Record retention policies ensure that data is kept in a usable state while it is needed and destroyed when it is no longer needed
4 Data Classification Level
Class 0:
> No Damage
Government (unclassified) : Available upon request, has been declassified
Public (public) : Website, ads, any information that publically accessible
Class 1 :
> Damage
Government (confidential) : Operational or battle report
Public (sensitive) : Networking, IP assignments, system information
Class 2 :
> Serious Damage
Government (secret) : Troop Plan, weakness reports
Public (private) : PHI, PII, payroll
Class 3 :
> Exceptionally grave damage
Government (top secret) : Weapon blueprints, war plan, espionage data
Public (proprietary) : trade secrets, source code
What is sensitive data?
any information that isn’t public or unclassified.
> PII (Personally Identifiable Information) any information that can identify an individual, biometric record, name, birthdate
PHI (Personal Health Information) health related information that can be related to specific person
What is Role of Data Owner?
Usually a member of senior management. Can delegate some day-to-day duties. Cannot delegate total responsibility
What is Role of Data Custodian?
Some in IT Department. Does not decide what controls are needed, but does implement controls and monitor control for data owner
What is role of Data Administrator?
Responsible for granting appropriate access to person/user
User : any person who accessess data via a computing system to accomplist work task
Security Administrator: Responsible for Firewall, IPS, IDS, security patches, grant access
Difference between Mission/Business Owner and Data Owner
Mission Owners typically own process and program, make policies that govern our data security. Data Owner: management levels, plans security control, assign sensitivity labels and backup frequency
Methods for Reducing GDPR Exposure
Anonymization: The process of removing all relevant data so that it is impossible to identify original subject or person, GDPR no longer relevant
Pseudonymization: process of replacing some data elements with pseudonyms or aliases. It removes privacy data so that a dataset can be shared. However, the original data remains available in a separate dataset.
What is tokenization?
Tokenization replaces data elements with a string of characters or a token. Credit card processors replace credit card data with a token, and a third party holds the mapping to the original data and the token.
The Information Life Cycle
Data Acquisition (data is created or copied from other location) > Data use (How we ensure data is kept Confidential, not altered, available when needed (CIA) <> Data Archival (data will be used later or retention required by law) > Data disposal (How do we dispose data properly)
Archive vs. Backup
Archive for long-term retention, Backup less useful for long time
3 Type of Data States
Data at Rest : is any data stored on media such as system hard drives, solid-state drives (SSDs), external USB drives, storage area networks (SANs), and backup tapes. Protection: Strong symmetric encryption protects data at rest
Data in Transit : is any data transmitted over a network, Protection: a combination of symmetric and asymmetric encryption protects data in transit
Data in Use : data in memory or temporary storage buffers while an application is using it. Protection: Use good practice, clean desk policy, print policy, no shoulder surfing, locking computer screen when leave
Who approve data access request?
Clearance request approved by Data Owner, especially if data was labelled as Top Secret
What is Clean Desk policy?
Clean desk policy requires employees to not have sensitive (or any at all) paperwork on their desks unless they are at the desk
Ensure security on Data handling, Data storage, and Data Retention?
Data handling: Only trusted individuals should handle our data; should have policy on how, where, why data was handled. Logs should be in place
Data Storage: should kepts in a secure, climate-controlled facility, and not far away.
Data Retention: should not kept beyond period of usefulness or legal requirement, HIPAA or PCI-DSS may require certain retention 1, 3, 7 years or infinity)
