Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sunflower Notes > Domain 2 - Asset Security > Flashcards

Domain 2 - Asset Security Flashcards

1
Q

Regarding Information Classification, define Categorization.

A

– Process of determining the impact of loss of CIA of information to an organization.

Identifies the value of the data to the organization. Not all data has same value, demonstrates business commitment to security.

Identify which information is most sensitive and vital

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information classification : Criteria

A

Value, age, useful life, personal association

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Information classification : Levels - Government, military

A
  • Unclassified (have FOUO also)
  • Sensitive but unclassified
  • Confidential (some damage)
  • Secret (Serious damage) (Can have Country specific restrictions also

– NZAUS SECRET for New Zealand, Australia and US secret)

  • Top Secret (Grave damage)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Information classification : Levels - Private sector

A
  • Public; used by public or employees
  • Company Confidential; viewed by all employees but not for general use
  • Company Restricted – restricted to a subset of employees
  • Private; Ex. SSN, credit card info., could cause damage
  • Confidential; cause exceptionally grave damage, Proprietary; trade secrets - Sensitive; internal business

TS = Confidential/Prop, Secret = Private, Confidential = sensitive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Policy?

A

Policies are high-level management directives that are mandatory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Senior management Statement of Policy

A

Stating importance, support and commitment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Types of Senior management Statement of Policy

A

Regulatory
Advisory
Informative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Regulatory Policy

A

Required due to laws, regulations, compliance and specific industry standards!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Advisory Policy

A

Not mandatory but strongly suggested

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Informative

A

To inform the reader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is an Information Policy?

A

Classifications and defines level of access and method to store and transmit information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are Securities Policy?

A

A document that defines the security requirements for an organization but it does not provide details how to fulfill the security needs or how to implement the policy.

Authenticates and defines technology used to control information access and distribution

Policies, standards, baselines, guidelines, and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Standards?

A

Specify use of specific technologies in a uniform way

Standards are tactical documents that define the steps or methods to accomplish the goals and overall direction defined by security policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are Guidelines?

A

Same as standards but not forced to follow

Guidelines offer recommendations on how standards and baselines are implemented and serve as an operational guide for both security professionals and users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are Procedures?

A

Detailed steps to perform a task

A procedure is a detailed, step-by-step how-to document that describes the exact actions necessary to implement a specific security mechanism, control, or solution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Baseline?

A

Minimum level of security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe Security planning.

A

Involves security scope, providing security management responsibilities and testing security measures for effectiveness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Strategic

A

5 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Tactical

A

Shorter than strategic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Operational

A

Day to day, short term

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Data Classification Policy

A
  • Who will have access to data?
  • How is the data to be secured?
  • How long is data to be retained?
  • What method(s) should be used to dispose of data?
  • Does data need to be encrypted?
  • What is the appropriate use of the data?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

IT Asset Management (ITAM)

A

Full life cycle management of IT assets - CMBD; holds relationships between system components

– incidents, problems, known error, changes, and releases

  • Single repository - Organizationally aligned
  • scalable
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

US-EU (Swiss) Safe Harbor

A

The EU Data Protection Directive To be replaced, in 2018, by the General Data Protection Regulation (GDPR) Bridge differences in approach and provide a streamlined means for U.S. organizations to comply with European Commissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

General Data Protection Regulation (GDPR)

A

STRENGTHING INDIVIDUALS RIGHTS

  • Data obtained fairly and lawfully
  • Data only used for original purpose
  • Adequate, relevant, and not excessive to purpose
  • Accurate and up to date
  • Accessible to the subject
  • Kept secure
  • Destroyed after purpose is complete
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Directive on Data Protection; Seven Tenets

“Daisy DANCES”

A

“Daisy DANCES”

Disclosure
Data Integrity
Access
Notice
Consent
Enforcement
Security
  • Notice; data subjects should be given notice when their data is being collected
  • Consent; data should not be disclosed without the data subject’s consent
  • Disclosure - Onward Transfer; data subjects should be informed as to who is collecting their data
  • Security; collected data should be kept secure from any potential abuses
  • Data Integrity; reliable, only stated purpose
  • Access; data subjects should be allowed to access their data and make corrections to any inaccurate data
  • Enforcement; accountability, data subjects should have a method available to them to hold data collectors accountable for not following the above principles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Data Processors

A

Example: When US Org classify and handle data

Data processors have responsibility to protect privacy of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Business/Mission owners

A

EU company would be Business/Mission owners, US org. would also be Data Administrators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the Roles and responsibilities of the Information security Officer?

A

Functional responsibility

  • Ensure policies etc. are written by app. Unit
  • Implement/operate CIRTs
  • Provide leadership for security awareness
  • Communicate risk to senior management
  • Stay abreast of current threats and technology
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the role of a Security Analyst?

A

Strategic, develops policies and guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Data Life

A
  • Creation, use, destruction(subservient to security policy)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Roles and responsibilities of the Data/Information Owner

A
  • Ultimate organizational responsibility for data
  • Categorize systems and data, determine level of classification
  • Required controls are selected for each classification
  • Select baseline security standards
  • Determine impact information has on organization
  • Understand replacement cost (if replaceable)
  • Determine who needs the information and circumstances for release
  • Determine when information should be destroyed
  • Responsible for asset - Review and change classification
  • Can delegate responsibility to data custodian
  • Authorize user privileges
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Roles and responsibilities of the Data Custodian

A
  • Day-to-day tasks, grants permission to users in DAC
  • Adhere to data policy and data ownership guidelines
  • Ensure accessibility, maintain and monitor security
  • Dataset maintenance, , archiving
  • Documentation, including updating
  • QA, validation and audits
  • Run regular backups/restores and validity of them
  • Insuring data integrity and security (CIA)
  • Maintaining records in accordance to classification
  • Applies user authorization
  • Implement security controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Roles and responsibilities of the System Owners

A

Select security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Roles and responsibilities of the Administrators

A

Assign permission to access and handle data

35
Q

Roles and responsibilities of the End-user

A
  • Uses information as their job
  • Follow instructions in policies and guidelines
  • Due care (prevent open view by e.g. Clean desk)
  • Use corporation resources for corporation use
36
Q

Roles and responsibilities of the Auditor

A

Examines security controls

37
Q

Quality Control

A

Assessment of quality based on internal standards

38
Q

Quality Assessment

A

Assessment of quality based on standards external to the process and involves reviewing of the activities and quality control processes.

39
Q

What are Data Remanence?

A

Residual physical representation of data that has been in some way erased. PaaS deals with it best in Cloud

40
Q

What are some methods to remove Data Remanence?

A
  • Physical destruction
  • Degaussing
  • Overwriting

NOT Reformatting

41
Q

Sanitizing

A

Series of processes that removes data, ensures data is unrecoverable by any means.

Removing a computer from service and disposed of. All storage media removed or destroyed.

42
Q

Degaussing

A

AC erasure; alternating magnetic fields ,

DC erasure; unidirectional magnetic field or permanent magnet, can erase tapes

43
Q

Erasing

A

deletion of files or media, removes link to file, least effective

44
Q

Overwriting/wiping/shredding

A

overwrites with pattern, may miss

45
Q

Zero fill

A

wipe a drive and fill with zeros

46
Q

Clearing

A

Prepping media for reuse at same level. Removal of sensitive data from storage devices in such a way that the data may not be reconstructed using normal system functions or utilities. May be recoverable with special lab equipment. Data just overwritten.

47
Q

Purging

A

More intense than clearing. Media can be reused in lower systems. Removal of sensitive data with the intent that the data cannot be reconstructed by any known technique.

48
Q

Destruction

A

Incineration, crushing, shredding, and disintegration are stages of this

49
Q

How do you secure files sent through the Internet?

A

Encrypt data

50
Q

SSD Data Destruction

A

NIST says to “disintegrate”

  • SSD drives cannot be degaussed, space sectors, bad sectors, and wear space/leveling may hide nonaddressable data, encrypt is the solution
  • Erase encryption key to be unreadable
  • Crypto erase, sanitization, targeted overwrite (best)
51
Q

What is a Baseline?

A

Starting point that can be tailored to an organization for a minimum security standard. Common security configurations,

Use Group Policies to check and enforce compliance

52
Q

What is the importance of Scoping and Tailoring?

A

Narrows the focus and of the architecture to ensure that appropriate risks are identified and addressed.

53
Q

Scoping

A

Reviewing baseline security controls and selecting only those controls that apply to the IT system you’re trying to protect.

54
Q

Tailoring

A

Modifying the list of security controls within a baseline so that they align with the mission of the organization.

55
Q

Supplementation

A

Adding assessment procedures or assessment details to adequately meet the risk management needs of the organization.

56
Q

Link Encryption

A

Link Encryption encrypts ALL the data along a specific communication path

User information, header, trailers, addresses, and routing data that are part of the packets are also encrypted.

57
Q

End to End Encryption

A

The header, trailers, addresses, and routing data are NOT encrypted.

Hackers can capture the packet and read it.

58
Q

FTP and Telnet

A

Unencrypted

59
Q

SFTP and SSH

A

Provide encryption to protect data and credentials

60
Q

How do you protect Removable Media?

A

Use strong encryption, like AES256, to ensure loss of media does not result in data breach

61
Q

CIS

A

Center for Internet Security; creates list of security controls for OS, mobile, server, and network devices

62
Q

NIST

A

National Institute of Standards and Technology

63
Q

NIST SP 800 series

A

Address computer security in a variety of areas

64
Q

800-14 NIST SP

A

GAPP for securing information technology

65
Q

800-18 NIST

A

How to develop security plans

66
Q

800-27 NIST SP

“Insane Dentists Invented Old Dogs”

A

Baseline for achieving security,

five life cycle planning phases (defined in 800-14), 33 IT security principles

“Insane Dentists Invented Old Dogs”

  • Initiation
  • Development/Acquisition
  • Implementation
  • Operation/Maintenance
  • Disposal
67
Q

800-88

A

NIST guidelines for sanitation and disposition, prevents data remanence

68
Q

800-122

A

NIST Special Publication – defines PII as any information that can be used to trace a person identity such as SSN, name, DOB, place of birth, mother’s maiden name

69
Q

800-137

A

build/implement info security continuous monitoring program: define, establish, implement, analyze and repor

70
Q

800-145

A

cloud computing

71
Q

FIPS

A

Federal Information Processing Standards; official series of publications relating to standards and guidelines adopted under the FISMA, Federal Information Security Management Act of 2002.

72
Q

FIPS 199

A

Standards for categorizing information and information systems

73
Q

FIPS 200

A

minimum security requirements for Federal information and information systems

74
Q

DOD 8510.01

A

establishes DIACAP

75
Q

ISO 15288

A

International systems engineering standard covering processes and life cycle stages

  • Agreement
  • Organization Project
  • enabling
  • Technical Management
  • Technical
76
Q

COPPA

A

California Online Privacy Protection Act, operators of commercial websites post a privacy policy if collecting personal information on CA residents

77
Q

Curie Temperature

A

Critical point where a material’s intrinsic magnetic alignment changes direction

78
Q

DAR

A

Data at rest; inactive data that is physically stored, not RAM, biggest threat is a data breach, full disk encryption protects it (Microsoft Bitlocker and Microsoft EFS, which use AES, are apps)

79
Q

DLP

A

Data Loss/Leakage Prevention, use labels to determine the appropriate control to apply to data. Won’t modify labels in realtime.

80
Q

ECM

A

Enterprise Content Management; centrally managed and controlled

81
Q

Non-disclosure Agreement (NDA)

A

legal agreement that prevents employees from sharing proprietary information

82
Q

PCI-DSS

A

Payment and Card Industry – Security Standards Council; credit cards, provides a set of security controls /standards

83
Q

Watermark

A

embedded data to help ID owner of a file, digitally label data and can be used to indicate ownership.

Sunflower Notes (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions