Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

- > Domain 2: Asset Security > Flashcards

Domain 2: Asset Security Flashcards

1
Q

Information lifecycle

A

Acquisition, Use, Archival and Disposal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define the Acquisition information lifecycle stage?

A

This includes creation or copying of data and applying policy controls, such as encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define the Use information lifecycle stage?

A

Where data is read or modified by users. Need to ensure confidentiality, integrity and availability are applied here.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define the Archival information lifecycle stage?

A

Process of archiving or backing-up data for business or regulatory purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define the Disposal information lifecycle stage?

A

Process of destruction of data that is no longer needed. Data must be rendered sufficiently difficult for an adversary to recover so that the risk of such recovery is acceptable to our organisation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Data Classification

A

Development of sensitivity labels based on value of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define PII

A

Personally Identifiable Information. This is any information about an individual. This can include name, social security number, DOB, biometric records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define PHI

A

Protected Health Information. This is any health related information that can be related to a specific person. The Health Insurance Portability and Accountability Act (HIPAA) mandates the protection of PHI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Types of data that classification levels apply to?

A

ALL data, regardless of format, including digital, paper, video, fax, audio etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define common levels of classifications for Government/Military use

A

Top Secret, Secret, Confidential, Sensitive but unclassified, and Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define common levels of classifications for private/commercial use

A

Confidential, Private, Sensitive, Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define information classification

A

Process of understanding the value and assigning classification labels for both physical assets, and digital assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define asset classification

A

Ensure that physical assets are also adequately protected, through use of sensitivity classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data protection key considerations

A

Who has access to the data, what controls are in place, and what devices can be used to access data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Three states of data

A

Data at Rest, Data in Transit, Data in Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define Data at Rest

A

Involves data stored on media such as system hard drives, external USB drives, and backup tapes. Use of encryption is popular here.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define Data in Transit

A

Involves data transmitted over a network. Use of TLS is applied here

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define Data in Use

A

Refers to data in memory or temporary storage buffers, while an application is using it. Application buffers are typically cleared after use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define data breach

A

Any event in which an unauthorised entity can view or access sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define data leak

A

Where the confidentiality of data has been compromised

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Role of Executives

A

Hold ultimate responsibility for everything that happens in their organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CSO vs CISO

A

CSO focused on broader security risks (including, physical security), while CISO is typically much more technology focused

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define role of Data Owners

A

Responsible for ensuring the necessary security controls are in place, defining the security classifications and requirements. Owners can be held liable for negligence if they fail to perform due diligence in establishing and enforcing security policies to protect and sustain sensitive data.

24
Q

Rules of Behaviour

A

Clearly delineate responsibilities and expected behavior of all individuals with access to the system.

25
Q

Data custodians

A

Help protect data on a day-to-day basis. This includes, implementing and maintaining security controls, performing regular backups, validating integrity of data, restoring from backup media, retaining audit logs.

26
Q

Asset/System Owner

A

Person who owns the asset. Ensures system is labelled accurately and that appropriate security controls are in place.

27
Q

Business/Mission Owners

A

Responsible for ensuring systems provide value to business

28
Q

Data processors

A

Any system/person that processes personal data on behalf of data controller

29
Q

Data controllers

A

Person or entity that controls processing of data

30
Q

Data Administrator

A

Responsible for granting appropriate access to personnel

31
Q

Users

A

Any person who has access to data to accomplish work tasks

32
Q

Security Administrator

A

Responsible for implementing and maintaining specific security network devices and software in the enterprise

33
Q

Supervisor

A

Responsible for all user activity and any assets created and owned by these users

34
Q

Change control analyst

A

Responsible for approving or rejecting requests to make changes to the network, systems, or software

35
Q

Data analyst

A

Ensures company data is stored properly and follows a standardised naming scheme

36
Q

Auditor

A

Auditors check that the organisation complies with its own policies, and applicable laws and regulations.

37
Q

Four principles of retention

A

Taxonomy: scheme for classifying data, such as HR-1
Classification: use of sensitivity labels
Normalisation: retained data can come in a variety of formats, but can be read universally
Indexing: data can be accessed quickly

38
Q

E-Discovery

A

Process of collecting and processing electronic material for use in litigation.

  1. Identification
  2. Preservation
  3. Collection
  4. Processing
  5. Review
  6. Analysis
  7. Production
  8. Presentation
39
Q

Pseudonymisation

A

Use of alias, to represent other data. Such as use of patient number, instead of name.

40
Q

Anonymisation

A

Process of removing all relevant data so that it is impossible to identify the original

41
Q

Data Masking

A

Masks data in individual columns, so it cannot be identified

42
Q

Erasing

A

Simply deleting a file from the device

43
Q

Clearing (overwriting)

A

Overwriting a file with other junk

44
Q

Purging

A

More intensive version of clearing. This overwrites data multiple times, however, is not suitable for top secret data.

45
Q

Degaussing

A

Use of magnetic fields to destroy HDD’s and magnetic tapes

46
Q

Scoping

A

Process of taking a broader standard and trimming out the irrelevant or otherwise unwanted parts

47
Q

Tailoring

A

Customising specific provisions so they better address your requirements.

48
Q

Define DLP

A

Data Loss Prevention, focused on preventing unauthorised external parties from gaining access to sensitive data. NOT for internal parties.

49
Q

Four Step DLP Process

A
  1. Data Inventory: identify the most important data
  2. Data Flows: ensure that DLP tools are used strategically through specific network pathways.
  3. Data Protection Strategy: Through a risk assessment
  4. Implementation, Testing, and Tuning: Focus on ensuring the accuracy, interoperability, and policy engine are adequate for organisation’s needs.
50
Q

Types of DLP

A
  1. Network DLP: Usually implemented at network perimeter, for the protection of data in motion.
  2. Endpoint DLP: Applies protection policies to data at rest and in use on endpoint devices.
  3. Hybrid DLP: Combination of both NDLD and EDLP
51
Q

EU-US Privacy Shield

A

It is a framework for regulating exchange of information between EU and USA. One of its purposes is to enable US companies to more easily receive personal data from EU entities under EU privacy laws, meant to protect European Union Citizens.

52
Q

7 Principles of EU-US Privacy Shield

A
  1. Notice: an organisation must inform individuals about the purposes for which it collects and uses information about them
  2. Choice: an organisation must offer individuals the opportunity to opt out
  3. Accountability for onward transfer: organisations can only transfer data to other orgnaisations that comply with Notice and Choice principles.
  4. Security: must take reasonable precautions to protect personal data.
  5. Data integrity and purpose limitation: organisations should only collect data that is needed for processing purposes identified in the Notice principle.
  6. Access: individuals must have access to personal information on organisation holds about them.
  7. Recorse, enforcement, and liability: organisations must implement mechanisms to ensure compliance with the principles and provide mechanisms to handle individual complaints.
53
Q

System hardening

A

Removing unncessary services, and changing default settings

54
Q

Obfuscation

A

Process of hiding, replacing or omitting sensitive information

55
Q

Tokenisation

A

Process of using tokens to represent other data, this is is similar to pseudonymization.

- (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions