Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Sunflower Notes > Domain 2 - Asset Security > Flashcards

Domain 2 - Asset Security Flashcards

1
Q

Regarding Information Classification, define Categorization.

A

– Process of determining the impact of loss of CIA of information to an organization.

Identifies the value of the data to the organization. Not all data has same value, demonstrates business commitment to security.

Identify which information is most sensitive and vital

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information classification : Criteria

A

Value, age, useful life, personal association

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Information classification : Levels - Government, military

A
  • Unclassified (have FOUO also)
  • Sensitive but unclassified
  • Confidential (some damage)
  • Secret (Serious damage) (Can have Country specific restrictions also

– NZAUS SECRET for New Zealand, Australia and US secret)

  • Top Secret (Grave damage)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Information classification : Levels - Private sector

A
  • Public; used by public or employees
  • Company Confidential; viewed by all employees but not for general use
  • Company Restricted – restricted to a subset of employees
  • Private; Ex. SSN, credit card info., could cause damage
  • Confidential; cause exceptionally grave damage, Proprietary; trade secrets - Sensitive; internal business

TS = Confidential/Prop, Secret = Private, Confidential = sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Policy?

A

Policies are high-level management directives that are mandatory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Senior management Statement of Policy

A

Stating importance, support and commitment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Types of Senior management Statement of Policy

A

Regulatory
Advisory
Informative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Regulatory Policy

A

Required due to laws, regulations, compliance and specific industry standards!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Advisory Policy

A

Not mandatory but strongly suggested

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Informative

A

To inform the reader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Information Policy?

A

Classifications and defines level of access and method to store and transmit information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are Securities Policy?

A

A document that defines the security requirements for an organization but it does not provide details how to fulfill the security needs or how to implement the policy.

Authenticates and defines technology used to control information access and distribution

Policies, standards, baselines, guidelines, and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Standards?

A

Specify use of specific technologies in a uniform way

Standards are tactical documents that define the steps or methods to accomplish the goals and overall direction defined by security policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are Guidelines?

A

Same as standards but not forced to follow

Guidelines offer recommendations on how standards and baselines are implemented and serve as an operational guide for both security professionals and users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are Procedures?

A

Detailed steps to perform a task

A procedure is a detailed, step-by-step how-to document that describes the exact actions necessary to implement a specific security mechanism, control, or solution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Baseline?

A

Minimum level of security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe Security planning.

A

Involves security scope, providing security management responsibilities and testing security measures for effectiveness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Strategic

A

5 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Tactical

A

Shorter than strategic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Operational

A

Day to day, short term

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data Classification Policy

A
  • Who will have access to data?
  • How is the data to be secured?
  • How long is data to be retained?
  • What method(s) should be used to dispose of data?
  • Does data need to be encrypted?
  • What is the appropriate use of the data?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

IT Asset Management (ITAM)

A

Full life cycle management of IT assets - CMBD; holds relationships between system components

– incidents, problems, known error, changes, and releases

  • Single repository - Organizationally aligned
  • scalable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

US-EU (Swiss) Safe Harbor

A

The EU Data Protection Directive To be replaced, in 2018, by the General Data Protection Regulation (GDPR) Bridge differences in approach and provide a streamlined means for U.S. organizations to comply with European Commissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

General Data Protection Regulation (GDPR)

A

STRENGTHING INDIVIDUALS RIGHTS

  • Data obtained fairly and lawfully
  • Data only used for original purpose
  • Adequate, relevant, and not excessive to purpose
  • Accurate and up to date
  • Accessible to the subject
  • Kept secure
  • Destroyed after purpose is complete
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Directive on Data Protection; Seven Tenets "Daisy DANCES"
"Daisy DANCES" ``` Disclosure Data Integrity Access Notice Consent Enforcement Security ``` - Notice; data subjects should be given notice when their data is being collected - Consent; data should not be disclosed without the data subject’s consent - Disclosure - Onward Transfer; data subjects should be informed as to who is collecting their data - Security; collected data should be kept secure from any potential abuses - Data Integrity; reliable, only stated purpose - Access; data subjects should be allowed to access their data and make corrections to any inaccurate data - Enforcement; accountability, data subjects should have a method available to them to hold data collectors accountable for not following the above principles
26
Data Processors
Example: When US Org classify and handle data Data processors have responsibility to protect privacy of data
27
Business/Mission owners
EU company would be Business/Mission owners, US org. would also be Data Administrators
28
What are the Roles and responsibilities of the Information security Officer?
Functional responsibility - Ensure policies etc. are written by app. Unit - Implement/operate CIRTs - Provide leadership for security awareness - Communicate risk to senior management - Stay abreast of current threats and technology
29
What is the role of a Security Analyst?
Strategic, develops policies and guidelines
30
Data Life
- Creation, use, destruction(subservient to security policy)
31
Roles and responsibilities of the Data/Information Owner
- Ultimate organizational responsibility for data - Categorize systems and data, determine level of classification - Required controls are selected for each classification - Select baseline security standards - Determine impact information has on organization - Understand replacement cost (if replaceable) - Determine who needs the information and circumstances for release - Determine when information should be destroyed - Responsible for asset - Review and change classification - Can delegate responsibility to data custodian - Authorize user privileges
32
Roles and responsibilities of the Data Custodian
- Day-to-day tasks, grants permission to users in DAC - Adhere to data policy and data ownership guidelines - Ensure accessibility, maintain and monitor security - Dataset maintenance, , archiving - Documentation, including updating - QA, validation and audits - Run regular backups/restores and validity of them - Insuring data integrity and security (CIA) - Maintaining records in accordance to classification - Applies user authorization - Implement security controls
33
Roles and responsibilities of the System Owners
Select security controls
34
Roles and responsibilities of the Administrators
Assign permission to access and handle data
35
Roles and responsibilities of the End-user
- Uses information as their job - Follow instructions in policies and guidelines - Due care (prevent open view by e.g. Clean desk) - Use corporation resources for corporation use
36
Roles and responsibilities of the Auditor
Examines security controls
37
Quality Control
Assessment of quality based on internal standards
38
Quality Assessment
Assessment of quality based on standards external to the process and involves reviewing of the activities and quality control processes.
39
What are Data Remanence?
Residual physical representation of data that has been in some way erased. PaaS deals with it best in Cloud
40
What are some methods to remove Data Remanence?
- Physical destruction - Degaussing - Overwriting NOT Reformatting
41
Sanitizing
Series of processes that removes data, ensures data is unrecoverable by any means. Removing a computer from service and disposed of. All storage media removed or destroyed.
42
Degaussing
AC erasure; alternating magnetic fields , DC erasure; unidirectional magnetic field or permanent magnet, can erase tapes
43
Erasing
deletion of files or media, removes link to file, least effective
44
Overwriting/wiping/shredding
overwrites with pattern, may miss
45
Zero fill
wipe a drive and fill with zeros
46
Clearing
Prepping media for reuse at same level. Removal of sensitive data from storage devices in such a way that the data may not be reconstructed using normal system functions or utilities. May be recoverable with special lab equipment. Data just overwritten.
47
Purging
More intense than clearing. Media can be reused in lower systems. Removal of sensitive data with the intent that the data cannot be reconstructed by any known technique.
48
Destruction
Incineration, crushing, shredding, and disintegration are stages of this
49
How do you secure files sent through the Internet?
Encrypt data
50
SSD Data Destruction
NIST says to “disintegrate” - SSD drives cannot be degaussed, space sectors, bad sectors, and wear space/leveling may hide nonaddressable data, encrypt is the solution - Erase encryption key to be unreadable - Crypto erase, sanitization, targeted overwrite (best)
51
What is a Baseline?
Starting point that can be tailored to an organization for a minimum security standard. Common security configurations, Use Group Policies to check and enforce compliance
52
What is the importance of Scoping and Tailoring?
Narrows the focus and of the architecture to ensure that appropriate risks are identified and addressed.
53
Scoping
Reviewing baseline security controls and selecting only those controls that apply to the IT system you’re trying to protect.
54
Tailoring
Modifying the list of security controls within a baseline so that they align with the mission of the organization.
55
Supplementation
Adding assessment procedures or assessment details to adequately meet the risk management needs of the organization.
56
Link Encryption
Link Encryption encrypts ALL the data along a specific communication path User information, header, trailers, addresses, and routing data that are part of the packets are also encrypted.
57
End to End Encryption
The header, trailers, addresses, and routing data are NOT encrypted. Hackers can capture the packet and read it.
58
FTP and Telnet
Unencrypted
59
SFTP and SSH
Provide encryption to protect data and credentials
60
How do you protect Removable Media?
Use strong encryption, like AES256, to ensure loss of media does not result in data breach
61
CIS
Center for Internet Security; creates list of security controls for OS, mobile, server, and network devices
62
NIST
National Institute of Standards and Technology
63
NIST SP 800 series
Address computer security in a variety of areas
64
800-14 NIST SP
GAPP for securing information technology
65
800-18 NIST
How to develop security plans
66
800-27 NIST SP "Insane Dentists Invented Old Dogs"
Baseline for achieving security, five life cycle planning phases (defined in 800-14), 33 IT security principles "Insane Dentists Invented Old Dogs" - Initiation - Development/Acquisition - Implementation - Operation/Maintenance - Disposal
67
800-88
NIST guidelines for sanitation and disposition, prevents data remanence
68
800-122
NIST Special Publication – defines PII as any information that can be used to trace a person identity such as SSN, name, DOB, place of birth, mother’s maiden name
69
800-137
build/implement info security continuous monitoring program: define, establish, implement, analyze and repor
70
800-145
cloud computing
71
FIPS
Federal Information Processing Standards; official series of publications relating to standards and guidelines adopted under the FISMA, Federal Information Security Management Act of 2002.
72
FIPS 199
Standards for categorizing information and information systems
73
FIPS 200
minimum security requirements for Federal information and information systems
74
DOD 8510.01
establishes DIACAP
75
ISO 15288
International systems engineering standard covering processes and life cycle stages - Agreement - Organization Project - enabling - Technical Management - Technical
76
COPPA
California Online Privacy Protection Act, operators of commercial websites post a privacy policy if collecting personal information on CA residents
77
Curie Temperature
Critical point where a material’s intrinsic magnetic alignment changes direction
78
DAR
Data at rest; inactive data that is physically stored, not RAM, biggest threat is a data breach, full disk encryption protects it (Microsoft Bitlocker and Microsoft EFS, which use AES, are apps)
79
DLP
Data Loss/Leakage Prevention, use labels to determine the appropriate control to apply to data. Won’t modify labels in realtime.
80
ECM
Enterprise Content Management; centrally managed and controlled
81
Non-disclosure Agreement (NDA)
legal agreement that prevents employees from sharing proprietary information
82
PCI-DSS
Payment and Card Industry – Security Standards Council; credit cards, provides a set of security controls /standards
83
Watermark
embedded data to help ID owner of a file, digitally label data and can be used to indicate ownership.

Sunflower Notes (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions