Domain 2 - Asset Security Flashcards
What are the commercial data classifications? (From Grave Damage to No damage)
- Proprietary/Confidential
- Private
- Sensitive
- Public
What are the US Government Data Classification?
- TOP SECRET
- SECRET
- COMMERCIAL
- Unclassified
What principle of security does compartmentalisation apply?
Need-to-know
What activities are used to assist an organisation in forming a minimum security baseline?
Scoping and tailoring
What is scoping?
Process of determining which portions of a standard will be used by the organisation. Example is the Statement of Applicability (SoA)
What is tailoring?
Tailoring is the process of customising a standard for a organiation:
1. control selection for initial security baseline
2. scoping for the remaining baseline security controls
3. Application of compensating controls
What is pseudonymisation?
De-identification process to remove PII.
This can be reversed as it is like an alias.
What is anonymisation?
Process to either encrypt or remove PII. This is irreversible. However data inference can still be used to counter anonymisation.
What is tokenisation?
A value that is substituted to replace a sensitive data item. e.g. payment card data.
What should asset classification be based on?
This should be based on the data classification. If it processes SECRET data then the computer should be classified the same.
What should PHI, PII, financial data, employee data, payroll data be classified as?
Private
What is the role of the system owner?
- Creation of SSP
- Ensures users receive adequate training
- Assists with identification, implementation and assessment of common security controls
What is the role of business/mission owners?
- Senior executives that make the policies that govern the data security.
What is the role of data controllers?
Controllers create and manage sensitive data in the organisation (e.g. HR/Payroll)
What is the role of data processors?
Processors manage the data for controllers (e.g. outsourced payrolll)
What is the role of data owners?
They assign sensitivity labels and backup frequency.
What is the responsibility of security administrators?
- Firewalls
- IPS
- IDS
- Security patches
- Create accounts
- Assigns access to data (could also be data administrator).
What is PROM?
This is programmable read only once memory
What is EPROM?
This is erasable programmable read only memory where reprogramming can be done many times using ultraviolet light.
What is EEPROM?
Electrically erasable programmable read only memory. Reprogrammable using electric charges.
What type of RAM is usually embedded with CPU?
Static RAM (SRAM)
What type of RAM is inserted into motherboard slots?
Synchronous Dynamic RAM (SDRAM). This is where DDR4, etc comes in.
What type of RAM is embedded on graphic cards?
Dynamic RAM (DRAM)
Whare are SSD Drives made up of?
EEPROM and DRAM
What is flash memory made up of? (e.g USB)
EEPROM
What is an example of tailoring?
A standard or framework might say to use AES 128bit. Tailoring could be using a stronger encryption such as AES 256bit.
