Domain 2 - Asset Security Flashcards
Business/Mission Owners
- Senior Management
- Create the information program. ensure it’s staffed, funded, etc..
- Responsible for ensure assets are protected
Data Owners
- Management Employee
- Responsible for ensuring that specific data is protected
- Determine data sensitivity labels, frequency of backups
- Focus on the data itself (paper/electronic)
System Owner
- Management Employee
- Responsible for the actual systems that house the data
- Includes ASSURANCE OF hardware/software configuration (updates, patching, etc…)
Data Custodian
- Hands-on protection of assets, such as data
- PERFORMS backups, restoration, patches systems, configures AV, etc…
- Custodians FOLLOW ORDERS and do not make critical decisions
Data Controller
- Creates and manages sensitive data within an organization
- HR employees, etc…
Data Processor
- Manages data on behalf of data controllers
- Outsourced payroll, etc…
Data Remanence
Data that persists beyond noninvasive means to delete it
Memory
- Series of on-off switches representing bits
- May be chip-based, disk-based, tape, etc…
Real Memory
“Primary Memory”
- RAM
- Directly accessible by the CPU
- Used to hold instructions and data for currently executing processes
Secondary Memory
- Disk-based memory
- Not directly accessible by the CPU
Cache Memory
- Fastest memory on the system (must keep up with CPU)
Register File/Registers (memory)
- Fastest portion of the CPU
- Small storage locations used by the CPU to store instructions and data
Level 1 cache (memory)
- Next fastest behind register
- Located on the CPU itself
- SRAM
PROM
Programmable Read Only Memory
- Can be written to only once, typically at the factory
EPROM
Erasable Programmable Read Only Memory
- May be flashed using ultraviolet light
EEPROM
Electronically Erasable Programmable Read Only Memory
- Electronically flashable using ‘flashing programs’
PLD
Programmable Logic Device
- Field-programmable device (programmed AFTER it leaves the factory)
- EPROM, EEPROM, Flash Memory
SSD (Solid State Drive)
- Combination of flash memory (EEPROM) and DRAM
What type of memory is flash memory?
EEPROM - Electronically Erasable Programmable Read Only Memory
TRIM (SSD)
- Improves garbage collection
- Allows the drive to do garbage collection in the background
- TRIM improves performance but does NOT reliably destroy data
Garbage Collection (SSD)
- Removes unallocated blocks of memory
- Works during idle time so it does not impact performance
ATA Secure Erase
The only way to reliably wipe a SSD without physically destroying it
PCI-DSS
Payment Card Industries Data Security Standard
- AMEX, Discover, Mastercard, Visa, others…
PCI-DSS Core Principles
- Build and maintain a secure network and systems
- Protect cardholder data
- Maintain a vulnerability management program
- Implement strong access control measures
- Regularly monitor and test networks
- Maintain an information security policy
OCTAVE
Operationally Critical Threat, Asset, and Vulnerability Evaluation
- Risk Management Framework from Carnegie Mellon
- Three-phase process for managing risk
- FREE
OCTAVE Three-Phase Process
- Identifies staff knowledge, assets, and threats
- Identifies vulnerabilities and evaluates safeguards
- Conducts risk analysis and develops risk mitigation strategy
ISO
Internal Organization for Standardization
ISO 17799/27002
- 17799 was renamed to 27002 in 2005 to make it consistent with the 27000 series
- Describes TECHNIQUES and best practices
ISO 17799/27002 Areas (n=11)
§ Policy
§ Organization of information security
§ Asset management
§ Human resources security
§ Physical and environmental security
§ Communications and operations management
§ Access control
§ Information systems acquisition, development, and maintenance
§ Information security incident management
§ Business continuity management
§ Compliance
ISO 27001
Describes REQUIREMENTS
AUDITS the best practices (from 27002)
COBIT
Control Objectives for Information and Related Technology
- Framework for employing information security governance best practices
- Developed by ISACA
- Four Domains
- 34 Information Technology processes across the four domains
COBIT Domains (n=3)
- Plan and Organize
- Acquire and Implement
- Deliver and Support
- Monitor and Evaluate
**There are 34 IT processes across the 4 domains
ITIL
Information Technology Infrastructure Library
- ITSM Framework
- Five “Service Management Practices” publications
ITIL Service Management Practices (n=5)
- Service Strategy
- Service Design
- Service Transition
- Service Operation
- Continual Service Improvement
Public Sector Classification Levels
- Unclassified
- Sensitive but unclassified (SBU)
- Confidential
- Secret
- Top Secret
Private Sector Classification Levels
- Public
- Proprietary
- Private
- Confidential
- Sensitive
