Domain 2 Asset Security Flashcards
INFORMATION LIFECYCLE
Life-cycle models describe the changes an entity experiences during its
lifetime.
Information can generate other information, similar to reproduction.
The life cycle of information consists of four phases: acquisition, use,
archival, and disposal.
ACQUISITION
Information is typically copied or created from scratch.
Once acquired, it undergoes preparation, including the addition of
metadata and indexing.
It must be stored with policy controls, such as encryption for sensitive
data and access restrictions.
Proper planning at this stage is crucial for security and efficiency,
especially in larger organizations.
DISPOSAL
Data must eventually be destroyed or transferred to another party and then
destroyed.
Ensuring data is thoroughly and correctly destroyed is essential.
Data destruction methods include wiping, degaussing, or shredding
physical devices.
Proper destruction is complex when dealing with files, database
records, or systems with multiple data copies.
CLASSIFICATION PROCEDURE
- Define classification levels.
- Specify criteria for classifying data.
- Identify data owners responsible for classification.
- Identify data custodians responsible for maintaining security levels.
- Indicate required security controls for each classification level.
- Document any exceptions.
- Provide methods for transferring data custody.
- Review classifications periodically and communicate changes.
- Outline procedures for declassifying data.
- Include classification issues in security awareness training for all
employees.
LAYERS OF RESPONSIBILITY
Senior management sets the vision, goals, and business objectives.
Functional management understands departmental roles and security
impacts.
Operational managers and staff handle detailed technical and
procedural operations.
Each layer contributes to security practices, procedures, and controls.
SENIOR MANAGEMENT
RESPONSIBILITY:
● Senior managers, especially in the C-suite, carry ultimate responsibility
for the organization.
● They are accountable for organizational failures, fraud, and ensuring
due care in information security.
EXECUTIVE MANAGEMENT
● CEOs manage daily operations, strategic planning, and company growth
but cannot delegate ultimate responsibility.
● CFOs handle accounting, financial activities, and reporting to the SEC
and stakeholders.
● CIOs oversee the strategic management of information systems and
technology integration.
● CPOs ensure data privacy and compliance with legal and regulatory
requirements.
DATA CUSTODIAN
Data custodians are responsible for the day-to-
day management and maintenance of data assets, including implementing and enforcing security controls defined by the data owner.
SECURITY ADMINISTRATOR
Security administrators implement and maintain network security devices
and software.
SUPERVISOR
Supervisors manage user activity and inform security changes based on
employee status.
CHANGE CONTROL ANALYST
Change control analysts oversee the secure implementation of changes in
the network or software.
DATA ANALYST
Data analysts ensure data is organized and stored effectively to support
business objectives.
RETENTION POLICIES
● No global consensus on data retention duration; it varies by country and
sector.
● Essential to have a documented policy that’s regularly audited.
● Outsourced contracts should include data retention and eradication
terms.
● Using the longest legal retention time for all data can be impractical
and costly.
● Different business units may have different retention needs.
● Segregate data based on specific legal retention requirements.
DATA OWNERS
● Responsible for data classification and approving disclosure requests.
● Senior managers usually act as data owners.
● Policies should be in place to guide decisions on data access, with
exceptions documented.
DATA PROCESSORS
● Key to protecting or compromising data privacy.
● Need clear guidelines on acceptable behavior and policy adherence.
● Require training and routine auditing to ensure compliance with laws and
policies.
DATA REMANENCE
Data remanence refers to the residual data traces that remain on a storage medium after deletion or formatting. This residual data can be recovered and pose a security risk if not properly sanitized.
PROTECTING ASSETS
● Physical security combats theft, service interruptions, physical damage,
unauthorized access, and compromised system integrity.
● Real loss includes replacement costs, productivity and reputation impact,
consultant fees, and the restoration of data and production levels.
● Risk analysis involves inventory and valuation of hardware and the
valuable information within.
DATA SECURITY CONTROLS
Data at Rest
Vulnerable to physical access and network threats.
- Encrypted data is safer, but it is not always the default setting.
- Organizations are moving towards policies requiring encryption for
sensitive information, especially on portable devices.
DATA SECURITY CONTROLS
Data in Motion
- Most vulnerable when traversing networks.
- Strong encryption, like TLS or IPSec, is the best protection.
- Awareness of potential man-in-the-middle attacks is crucial.
DATA SECURITY CONTROLS
Data in Use
- Resides in primary storage and is difficult to protect as it’s usually
decrypted during use. - Side-channel attacks are a risk to data in use.
- Secure software development practices are necessary to mitigate risks.
MEDIA CONTROLS
● Media can be electronic or non-electronic and requires diverse controls
for data preservation.
● Proper environmental storage, access restrictions, and clear labeling are
key practices.
● Secure disposal methods are critical to prevent data breaches.
