Domain 2: Asset Security Flashcards
What is the information life cycle?
Information goes through a life cycle that starts with its acquisition and ends with its disposal.
How is new information prepared for use?
By adding metadata, including classification labels.
What is the risk of data replication?
Ensuring the consistency of data
What is an effect of data aggregation?
Data aggregation may lead to an increase in classification levels.
What is an effective control during the information life cycle?
Cryptography can be an effective control at all phases of the information life cycle.
What determines how information goes through the information life cycle?
The data retention policy drives the timeframe at which information transitions from the archival phase to the disposal phase of its life cycle.
Why classify information?
Information classification corresponds to the information’s value to the organization.
What differentiates different information classification?
Each classification should have separate handling requirements and procedures pertaining to how that data is accessed, used, and destroyed.
Who is ultimately responsible for an organization’s security?
Senior executives are ultimately responsible to the shareholders for the successes and failures of their corporations, including security issues.
Data owner
The data owner is the manager in charge of a specific business unit and is ultimately responsible for the protection and use of a specific subset of information.
Data owners vs. data custodians
Data owners specify the classification of data, and data custodians implement and maintain controls to enforce the set classification levels.
What consideratrions go into a data retention policy?
The data retention policy must consider legal, regulatory, and operational requirements.
What is a data retention policy?
The data retention policy should address what data is to be retained, where, how, and for how long.
E-discovery
Electronic discovery (e-discovery) is the process of producing for a court or external attorney all electronically stored information (ESI) pertinent to a legal proceeding.
NIST SP 800 - 88 , Revision 1
“Guidelines for Media Sanitization,” describes the best practices for combating data remanence.
How is overwriting data accomplished?
Overwriting data entails replacing the 1’s and 0’s that represent it on storage media with random or fixed patterns of 1’s and 0’s to render the original data unrecoverable.
Degaussing
Degaussing is the process of removing or reducing the magnetic field patterns on conventional disk drives or tapes.
Data at rest
Data at rest refers to data that resides in external or auxiliary storage devices, such as hard drives or optical discs.
How do you protect data at rest?
Whole-disk encryption is a good way to protect data at rest.
Data in motion
Data in motion is data that is moving between computing nodes over a data network such as the Internet.
How is cryptography used to protect data in motion?
- TLS
- IPSec
- VPNs
Data in use
Data in use is the term for data residing in primary storage devices, such as:
- Volatile memory (e.g. RAM)
- Memory caches
- CPU registers.
Scoping
Scoping is taking a broader standard and trimming out the irrelevant or otherwise unwanted parts.
Tailoring
Tailoring is when you make changes to specific provisions in a standard so they better address your requirements.
Data leak
A data leak means that the confidentiality of the data has been compromised.
Data leak prevention (DLP)
Data leak prevention (DLP) comprises the actions that organizations take to prevent unauthorized external parties from gaining access to sensitive data.
Network DLP
Network DLP (NDLP) applies data protection policies to data in motion.
Endpoint DLP
Endpoint DLP (EDLP) applies data protection policies to data at rest and data in use.
You need to declassify a data asset. Where should you look for guidance?
Your organization’s policies and procedures.
What is Data Leakage?
The unauthorized transmission of information to an external destination.
In order to determine what information protection to apply to given information, what must you know first?
The classification level of the data.
Erasing, purging, and degaussing are examples of what?
Data destruction.
True or false: all data should be handled in the same manner.
False
Each classification level shold have separate handling requirements and procedures.
Who should identify the classification of an information asset?
The information owner.
The information owner should:
- Understand the organization’s classification scheme
- Be familiar with legal and regulatory requirements
- Carry out classification processes in a consistent manner
- Have the processes reviewed
- Carry out declassification processes when necessary.
What is Asset Security?
The concept of identifying what assets you have and determine what types of controls are appropriate for each.
The types of assets and the types of controls should be defined in your organization’s policies, standards, and procedures.
What is the best way to ensure data privacy?
Limit the amount of data collected.
Who is responsible for checking to see if controls are being implemented properly?
Auditor.
Complete this sentence: “The longer you keep data, …”
“…the more liable you are.”
Businesses should take into account the useful life of data and associated legal and regulatory requirements to determine how long data should be retained.
Where should Data Marking be located on documents?
The cover and inside.
What is Data Archival?
A copy of data that is no longer in use, used in case the data is needed sometime in the future.
What are the four basic steps of the Information Life Cycle?
- Acquisition
- Classification and Marking
- Use and Archival
- Destruction
There are other life cycle models but this is the one we teach in the Human Element course.
Labeling data with the classification level is an example of what?
Data Marking
True or false: data is the only asset that needs to be classified.
False.
Applications and systems may also need to be classified.
What is “single pass” data overwriting?
Data is overwritten once with a “1” or a “0”.
After information is acquired by an organization what three steps should be taken?
- Attach system metadata
- Process metadata
- Index the data
The data is indexed to facilitate searching.
What is degaussing?
Magnetic scrambling of the data on a tape or disk.
Who is responsible for maintaning data and implementing data controls?
Data Custodian.
What is Data Remanence?
Residual representations of the data that remains after being erased.
Roles and responsibilities for data classification should be contained in what document?
Data Classification Policy.
What is a Data Backup?
A copy of data currently in use used for recovering from the loss of the original data.
