Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PCS CISSP MM, EC, Thor series > Domain 2 - Asset Security > Flashcards

Domain 2 - Asset Security Flashcards

1
Q

what are the stages to data lifecycle

A
  1. create/update
  2. store/classification
  3. use
  4. share
  5. archive
  6. destroy - data cant stay around longer than necessary. it creates risk and liability. It can be stolen, it can be called as evidence for legal actions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are some data security controls

A
  1. marketing, labeling, handling, classifications - classifications is the most important
  2. data handling - shipping, chain of custody. dont open boxes
  3. data destruction - erasing, clearing (overwriting w/ unclassified data)
    record retention - if the retention policy is 1 year, it should be destroyed when it ages out @ 1 year
  4. tape backup security - secure offsite facility, tapes labeled, ensure all understand the classification of the data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what is a security control baseling

A
  1. provides a listing of controls that an organization can apply as a baseline
  2. a group of controls that can be applied as a base standard or starting point that we work from
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

when it comes to data protection, what can you use to guarantee confidentiality

A

encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

should asset classification match data classification

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is (PII) personally identifiable information

A
  • any information that can identify and individual
  • (name (non common), SSN, birthdate/place, biometric records, education, medical history, financial transactions, mothers maiden name, criminal or employment history, etc.)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is (PHI) protected health information

A

health related information that can be related to a specific person (covered by HIPAA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

define Data owner/controller

A
  1. usually a member of senior management or the board
  2. accountable for the protection of data
  3. define level of classification - responsible for security decisions for DATA
  4. holds legal rights and defines policies
  5. can delegate some duties
  6. can not delegate responsibility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

define data custodian

A
  1. usually a member of IT
  2. does not decide what controls are needed
  3. implements controls from the data owner
  4. grants permissions, monitors, data archive, backup and restore checks, etc.
    **** on behalf of the data owner
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

define data administrator

A
  1. responsible for granting appropriate access to personnel (often via RBAC) - roll based access control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

define user

A

any person who accesses data via a computing system to accomplish work tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

define business/mission owner

A
  1. senior executives make the policies that govern our data security
  2. can overlap or or be the same as the system owner
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

define system owner

A
  1. management level and owner of the systems that house the data
  2. often a data center manager or infrastructure manager
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

define security administrators

A
  1. responsible for firewalls, IPS, IDS, security patches, creates accounts
  2. grants access to data following the data owners direction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

define supervisor

A
  1. responsible for user behavior and assets created by the users
  2. responsible for user awareness
  3. needs to inform the security administrator if there are any changes to user employment status, user access rights or any other pertinent changes to employees status
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

define asset owner

A
  1. owns assets or systems that process sensitive data and associated security plans
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

should each asset have an owner

A

yes, the owner is accountable for the protection of an asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what do baselines define

A

minimum security requirements for each class

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

define classification

A

a system of classes ordered according to value
example: public, proprietary, confidential is one possibility of the the three classification an organization might use to define classes, with public being the least valuable and confidential being the most valuable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is labeling of an asset

A
  1. noting the classification of an asset on an asset.
  2. the what, what the classification is
    example: putting a label on a backup tape noting that its top secret
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what is marking of an asset

A
  1. the how the asset should be protected based on its classification
  2. involves noting the handling instructions on the asset based on the classification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

what is categorization

A
  1. the act of sorting assets into the defined classes
  2. its a process of putting assets into different classes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

define data processor

A
  1. responsible for processing data on behalf of the owner
    typical example: cloud service provider. they are storing and processing data on behalf of the owner
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

define data subject

A
  1. the individual to whom any personal data relates, its data about them
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

ways to protect data at rest

A
  1. encryption
  2. strong access controls - to make sure authenticated and authorized persons have access to data
  3. backups - to verify data is not lost or destroyed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

end to end encryption attributes

A
  1. a protection for data in motion
  2. its encrypted right from the send and the data remains encrypted through all notes (switches, routers, firewalls etc.) that is passes on its way to the recipient
  3. only encrypted once it has reached the recipient, its never in plaintext in transit
    4 perfect example: VPN
  4. the downside the routing information (source and destination IP address) must be in plaintext
  5. this does not provide anonymity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

link encryption attributes

A

1 encrypted and decrypted at every node

  1. packet including the header is encrypted at the source and sent to the first destination
  2. first source decrypts the packet, looks for the destination address, re-encrypts the packet and forwards to the next node
  3. advantage - routing information is hidden in transit
  4. downside - its decrypted at every node, not the best for protecting data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

onion networks attributes

A
  1. provide confidentially and anonymity
  2. the sender device will predetermine a series of notes that the packet is going to pass through to the destination
  3. sender device will encrypt the entire packet for every node it will pass through
  4. each layer of encryption will use the specific encryption key for the next node, one layer (node) at a time
  5. last layer to be decrypted with only be at the destination and only then will the data be decrypted
  6. each node on the way only knows where the packet came from and the next node but not the ultimate source and destination
  7. each layer has zero access to the innermost layer
  8. downside is performance
    example of an onion network: TOR the onion router
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

how to protect data in use

A
  1. good access controls
  2. potentially data loss prevention controls to monitor and control what users are doing with the data
  3. data in use cannot be encrypted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

what is data archiving

A
  1. moving data that is no longer being used, to a cheaper storage solution for long term retention
  2. archived data is only kept as long as its useful or required by law
  3. protection of that data is in accordance to its classification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

data destruction from best to worst

A
  1. burn it
  2. shred/disintegrate or drill a hole in the media — with the right tools partial data can still be recovered
  3. degaussing - applying a very strong magnetic field to magnetic media like hard drives or tape (not SSD) – sits between destruction and purging (it might permanently render media unusable)
  4. crypto shredding – encrypt the data with an excellent algorithm like AES 256 then we destroy every copy of the key (sits between purging and clearing)
  5. overwriting, wiping, erasure, all refer to writing all zeros or ones or some combination to all the sectors of a storage device (research has shown that no matter how many times you overwrite the data, some of the data may be recoverable) thus this is clearing
  6. the worst method of destroying data is formatting the drive. formatting by default leaves most if not all the existing data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

3 types of defensible destruction in order from best down

A
  1. destruction
  2. purging
  3. clearing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

define privacy

A

the state or condition of being free from being observed or disturbed by other people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

what role do may regulations require the company to have

A

data controller - an owner for the privacy program that is accountable for the privacy controls within the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

what is the main thing we are protecting from a privacy perspective

A

personal data - information that can be used on it own or in combination to identify an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

what are 4 ways different laws can refer to personal information

A
  1. PII - personally identifiable information
  2. SPI - sensitive personal information
  3. PHI - personal health information
  4. PI - personal information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

what are direct identifiers and some examples

A

something that can identify and individual on it own.
examples: government IDs, social insurance numbers, social security number, drivers license numbers, passport numbers, back account numbers, phone numbers biometric data etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

what are indirect identifiers and examples

A

identifiers that on their own are not able to identify an individual but if you have enough indirect identifiers you can uniquely identify an individual
examples: age, gender, ethnicity, the state someone lives in, zip code or postal code etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

what are online identifiers and examples

A

individual identifiers that are online
examples: email address, IP addresses, cookies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

name this data lifecycle;
new data is generated or existing data is altered, updated or modified in some way

A

data creation/update

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

what happens in the store stage of the data lifecycle

A

data is committed to some sort of storage repository to memory or a hard drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

what is the 3rd stage and explanation of the 3 stage in the data lifecycle

A
  1. use stage
  2. this is where people or processes are “using” the data. this covers viewing, processing or in someway using the data but absolutely not modifying
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

explain the sharing stage of the data lifecycle

A

this is where we think about who the data can be shared with under what circumstances and with what controls in place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

what happens in the archive state of the day lifecycle

A
  1. this is where data is moved to cheaper long term storage (usually tapes) maybe some form of cloud
  2. that data should be retained for as long necessary based on the retention policy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

what is the last stage of the data lifecycle and explain

A
  1. destroy stage
  2. when data is no longer needed by the organization, this data should be physically or logically destroyed
  3. depending on requirements, data my need to be defensively destroyed
46
Q

what is the most important thing to do at the very start of the data lifecycle

A
  1. classify the data
  2. this shows how valuable the data is to the organization and drives the controls in each stage of the data lifecycle
47
Q

what are the government classifications from 3-0 and damage

A
  • top secret (3)- exceptionally grave damage
  • secret (2)- serious damage
  • confidential (1)- damage
  • unclassified (0)- no damage
48
Q

what are the public classifications and from 3-0 and damage with each

A
  • confidential/proprietary (3)- exceptionally grave damage
  • private (2)- serious damage
  • sensitive (1) - damage
  • public (0)- no damage
49
Q

data destruction - erasing is what

A

performing a delete operation against a file, files, or
media.

50
Q

data destruction - clearing (overwriting) is what

A
  • preparing media for reuse
  • when media is cleared, unclassified data is written over all addressable locations on the media.
  • data cannot be recovered using traditional recovery tools.
  • not sure on this statement. once completed the media can be reused at the same security level?
51
Q

data destruction - purging is what

A

a more intense form of clearing that prepares
media for reuse in less secure environments.

52
Q

data destruction - degaussing is what

A

creates a strong magnetic field that erases
data on some media.

53
Q

data destruction - destruction is what

A

the final stage in the lifecycle of media and is
the most secure method of sanitizing media.

54
Q

what is the correlation between asset classification and data classification

A

Asset classifications should match the data classifications.

55
Q

data steward

A
  • same as data custodian
  • Business responsibility for data (e.g. metadata definition, data quality, governance, compliance, etc.) on behalf of data owner
56
Q

define mission/business owner

A

senior executives, make policies that govern data

57
Q

define data processor

A
  • any entity that does processing of PII on behalf of the data owner [typically, a third party, external to the data owner]
  • typically an entity that works under the direction of the owner/controller, such as an IT department.
58
Q

define system owner

A

management level and owner of systems that house the data.
example: data center manager or infrastructure manager.

59
Q

define supervisor

A

responsible for users behavior and assets created by users. directly responsible for user awareness, informs security admins of changes to employee status, user rights or other employee status changes

60
Q

define users

A
  • User of data.
  • They must be trained on user awareness. They do not know acceptable uses and consequences for breaking policies, procedures and standards
61
Q

define auditors

A
  • responsible for reviewing and confirming security policies are implemented correctly, that we adhere to them and they provide the correct protection.
62
Q

Which Set Of Organizational Policies And Procedures Would Best Describe The Process For Moving Modified Source Code Into Production?

A. Change Management
B. Asset Management
C. Acceptable Use
D. Data Governance

A

Correct Answer: A

Change management policies describe the process for requesting, reviewing, implementing, and deploying changes in a production environment. This includes the release of new source code to production use. Asset management policies are used to track hardware, software, and other assets belonging to the organization. Acceptable use policies place restrictions on how users may interact with technology systems. Data governance policies set forth requirements for data ownership, stewardship, and care.

63
Q

what does data governance do

A
  • -improves data quality to be compliant with regulations/policies.
  • -Senior management is aware, accountable and committed.
  • -Data governance starts with strategy
64
Q

define data subject

A

the person who the information is about

65
Q

define data controller

A

same as data owner when a true data owner does not exist

66
Q

what are the military data classification Levels

A
  • top secret – disclosure could cause severe damage
  • secret – disclosure could cause serious damage
  • confidential – exempt from disclosure under law
  • sensitive but unclassified – disclosure could do some harm
  • unclassified – no classification or sensitivity
67
Q

with MAC access do objects or subjects have labels applied to them

A

• both

68
Q

how are labels used with access

A

• labels allow subjects with the right clearance to access them

69
Q

labels are more often more granular than top secret. how might that look

A
  • top secret then a nuclear sub category and maybe a submarine category within that
  • you would need the right access to get down to the submarine sub category
70
Q

opposite of CIA is what acronym and what is each side

A
  • DAD
  • disclosure
  • Alteration
  • Destruction
71
Q

what are the 3 states of data

A
  • at rest
  • in motion
  • in use
72
Q

securities for data at rest

A
  • data at rest is stored ( disk, tapes, cd’s, dvd’s, usb sticks)
  • backups
  • encryption (disk or device)
73
Q

securities for data in motion

A

• encrypt the network end to end (tls, ssh, IPsec) internal and external networks

74
Q

securities for data in use

A
  • preventing shoulder surfing ( monitor view angle covers)
  • clean desk policy
  • print policy (no leaving documents on printer, using key fob or key codes to print documents when you get to the printer)
  • locking computers
75
Q

how long do you keep data

A

• follow the letter of your organizations retention policy (no longer, no less)

76
Q

what entity’s should you be looking at for data storage retention policies

A
  • . your organizations policy
  • regulations (PCI DSS, HIPAA)
  • industry specific retention policies
77
Q

what is mission/business owner

A

• senior executive who make the policy that govern our security

78
Q

define data/information owner

A
  • management level, they assign sensitivity label’s and backup frequency
  • this could be you or a data owner from HR, payroll, or other department
79
Q

define system owner

A
  • management level and the owner of systems that house the data
  • often a data center manager or infrastructure manager
80
Q

define security administrator

A

• responsible for firewalls, IPS, IDS, security patches, create accounts, grant access to data according to data owner requirements.

81
Q

define supervisor

A
  • responsible for user behavior
  • responsible for user awareness
  • informs security administrator of any security changes (access rights, employee changes etc.)
82
Q

define users

A
  • users of data
  • user awareness must be trained
  • need to be taught was is acceptable and what is not
83
Q

define auditors

A

• responsible for reviewing and confirming security policies are implemented correctly, we adhere to them and they provide the protection required.

84
Q

is data deletion secure

A

• no – data is still completely recoverable

85
Q

is formatting considered secure

A
  • no – not much different than data deletion other than it puts a new file structure over the old one
  • its still completely recoverable
  • reformatting and reimaging is the same level of weakness with data destruction
86
Q

name the 3 main categories of data removal

A
  • clearing
  • purging (no recovery)
  • destroying
87
Q

what type of date removal fit into the category of clearing

A
  • wiping
  • overwriting
88
Q

is data clearing recoverable

A

• yes, with the correct tools

89
Q

what falls into the category of purging

A

• sanitizing the data (not the media)

90
Q

is purging data recoverable

A

• no

91
Q

what fit into the category of data destroying

A
  • shredding
  • burning
  • pulverizing
  • corrosive chemicals
92
Q

best methods for destroying data on SSD’s

A
  • crypto erase
  • purging
  • overwriting
  • best method is physical destruction
93
Q

what is scoping

A

• removing baseline security controls that do apply.
example: removing privacy controls where private data does not exist.

94
Q

what is tailoring

A

• modifying the baseline to become more applicable.
example: changing timeout requirements from 10 minutes to 5 minutes
choosing to use a stronger AES 256 encryptions over triple des

95
Q

what is certification

A
  • is the technical evaluation of the security compoent6ns within a produce (in my environment)
  • a formal process normally done by and outside auditor
96
Q

what is accreditation

A
  • the formal acceptance of the products overall security by senior management
  • risk is acceptable
  • certified products is approved to operate (be useable) after accreditation
97
Q

what does DRM stand for

A

• digital rights management

98
Q

what can be DRM

A
  • watermarks
  • encryption on DVD’s
  • copy restrictions (copy, edit, saving, screenshots, screen recording, printing)
99
Q

what does CASB stand for

A

• cloud access security broker

100
Q

what is a CASB

A
  • on premise or cloud software between users and cloud applications
  • monitors user activity
  • warns admins about possible malicious/dangerous, actions.
  • malware prevention, protects against shadow IT and enforces security policy compliance
101
Q

2 types of DLP

A
  • data loss protection
  • data leak protection
102
Q

what is exposure

A
  • the presence of a vulernability when a related threat exists
  • being susceptable to asset loss because of a threat; there is the possibiltiy that a vulnerability can or will be exploited
103
Q

do firewalls and intrusion detection systems ensure confidentiality, integrity and availability

A

perfect world yes! by always preventing unauthorized users access

104
Q

according to RFC 1087 Ethics and the Internet. what are 4 things that are unacceptable

A

a) seeks to gain unauthorized access to the resources of the internet
b) disrupts the intended use of the Internet
c) wastes resources (people, capacity, computer) through such actions,
d) destroys the integrity of computer-based information, and/or (e) compromises the privacy of users.

105
Q

common criteria (ISO 15408) levels

A
  • EAL1: Functionally Tested. …
  • EAL2: Structurally Tested. …
  • EAL3: Methodically Tested and Checked. …
  • EAL4: Methodically Designed, Tested, and Reviewed. …
  • EAL5: Semi-Formally Designed and Tested. …
  • EAL6: Semi-Formally Verified Design and Tested. …
  • EAL7: Formally Verified Design and Tested.
106
Q

KPI - what does it do

A
  1. Key Performance Indicator (KPI) is used to measure the effectiveness of the security controls associated with the risks.

Example: we develop an employee awareness program with sending simulated phishing emails to the employees, in order to train them on how to respond to phishing emails and measure their responsiveness. Assume the initial results shows 20% of the employees click on phishing emails, and our goal (our KPI) is to reduce that number to be 2%. If we see the number of employees clicking on phishing emails reduces during time, and getting close to that number, that indicates our control is working effectively.

107
Q

examples of PKIs

  • Create or know your baselines. abnormalities above and below your water mark is what you are looking for \
  • constantly need to be checking your PKIs vs your goals
A
  1. Level of Preparedness
    1. How many devices on your corporate network are fully patched and up to date?
  2. Unidentified Devices on Internal Networks
    1. Employees can introduce malware and other cyber risks when they bring in their own devices,
  3. Intrusion Attempts
    1. create a baseline and what for abnormalities
      1. too low could be something wrong with the detection or blocking controls
      2. too many, there could be an active attack
  4. Security Incidents
    1. How many times has an attacker breached your information assets or networks?
  5. Mean Time to Detect (MTTD)
    1. ‍How long do security threats go unnoticed? how long did it take to become aware of the indicators of compromise
  6. Mean Time to Resolve (MTTR)
    1. What is the mean response time for your team to respond to a cyber attack once they are aware of it?
108
Q

prudent man rule

A
  • Invoked by the Federal Sentencing Guidelines, the rule that requires senior officials to perform their duties with the care that ordinary, prudent people would exercise under similar circumstances.
109
Q
A
  1. data sanitization
110
Q

what is considered data sanitization

  1. degaussing
  2. crypto shredding
  3. destruction
  4. shred
A
  1. destruction
  2. shred

degaussing is on the line between sanitization (it can sometimes kill the drive) and purging

111
Q

what is considered purging

  1. wipe
  2. format
  3. degauss
  4. encryption
A

degauss (remember both destruction and purging)

112
Q

which are considered clearing data (data deletion

  1. overwrite/wipe/erasure
  2. format
  3. purging
  4. crypto shredding
A
  1. overwrite/wipe/erasure
  2. format
  • crypto shredding is on the line between purging and clearing
    • crypto shredding will render the data unusable if encrypted with a good algorithm and all the keys have been destroyed. but if the data is still there
    • if there was a weakness discovered in that algorithm or quantum computing became a thing, that data would be recoverable

PCS CISSP MM, EC, Thor series (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions