Domain 2 - Asset security Flashcards
Data Security Controls
○ Marking, labeling, handling, classification - classification is the most important
○ Data handling - shipping, chain of custody, don’t open boxes!
○ Data destruction - erasing, clearing (overwriting w/ unclassified data)
○ Record retention - if retention policy is 1 year, it should be destroyed when it ages out (1 year)
Tape backup security - secure facility, tapes labeled ensures all understand the classification of the data
Erasing (data destruction method)
performing a “delete” operation. Can be recoverable
Clearing aka overwriting (data destruction method)
prepping media for reuse and ensuring data cannot be recovered using traditional recovery tools
Purging (data destruction method)
-more intense form of clearing that preps media for reuse in less secure environments
-US gov does not approve this for top secret data
degaussing (data destruction method)
uses a magnetic field to erase data on physical media
destruction (data destruction method)
final stage in media lifecycle, most secure method of sanitizing media
Data classification
Top Secret - Class 3 - Confidential/ proprietary (grave damage)
Secret - Class 2 - Private (serious damage)
Confidential - Class 1 - Sensitive (damage)
Unclassified - Class 0 - Public (no damage)
PII
info that can identify and individual (name, SSN, birthdate, biometrics, etc)
PHI
health related info that can be linked to a person, covered by HIPAA
Data owner
usually senior management, can DELEGATE day to day duties, cannot delegate total responsibility
Data Custodian
usually someone in IT, DAY TO DAY, does not decide what controls are needed, but does implement controls for data owner
Data administrators (data ownership)
grants appropriate access to personnel (often via RBAC)
Business owner (data ownership)
can overlap responsibilities of the system owner or be the same role
Asset owner (data ownership)
owns an asset that processes sensitive data and associated sec plans
Data processor (GDPR term)
natural or legal person, public authority, agency, or other body, which processes personal data solely on behalf of the data controller, THIRD PARTY USUALLY
Data controller (GDPR term)
person or entity that controls processing of the data
Data transfer (GDPR term)
GDPR restricts data transfers to countries outside the EU
Anonymization
process of removing all relevant data so that it is impossible to identify original subject or person,
if done effectively GDPR is no longer relevant for the anonymized data, good if you don’t need the data
Pseudonymization
process of using pseudonyms (aliases) to represent the data,
need info but want to mask identities,
i.e. creating a patient number instead of a name, can result in less stringent requirements than would normally apply under GDPR
Device fingerprinting
can require user auth, can gather data like OS, versions, software info, and other info to uniquely identify a system
DRM
digital rights management
methods:
persistent online authentication, automatic expiration, continuous audit trail
