Domain 2: Asset Security; Ownership

Question 1

What are the five primary information security roles?

Answer 1

Business or Mission Owners
Data Owners
System Owners
Custodians
Users

Question 2

What is the responsibility of the Business or Mission Owner (Senior Management)?

Answer 2

Create the information security program and ensure it is properly staffed, funded, and has organizational priority. They are responsible for ensuring all organizational assets are protected.

Question 3

What is the Data Owner?

Answer 3

Is a management employee. Data owners determine data sensitivity levels and the frequency of data backup. The data owner performs management duties. Custodians perform the hands-on protection of data.

Question 4

What is the difference between Data Owner and a user who “owns” data?

Answer 4

The Data Owner ensures the data is protected. The user who “owns” the data has read/write access to objects.

Question 5

What are the responsibilities of a System Owner?

Answer 5

The System Owner is a manager responsible for the actual computers that house data. This includes the hardware and software configuration, including updates, patching, etc. They ensure the system is physically secure, operating systems are patched and up to date, the system is hardened, etc. The technical hands-on responsibilites are delegated to Custodians.

Question 6

Who is responsible for securing the data within a database? The system owner or the data owner?

Answer 6

The data owner is responsible for securing the data within a database.

Question 7

What does the Custodian do?

Answer 7

The Custodian provides hands-on protection of data. They follow detailed orders from the system owner or data owner, they do not make critical decisions on how data is protected.

Question 8

What are some things users must and must not do?

Answer 8

Users must follow the rules: they must comply with mandatory policies, procedures, standards, etc. Users must be made aware of risks and requirements via information security awareness. They must also be made aware of the penalty for failing to comply with mandatory directives such has policies.

Question 9

What is a Data Controller?

Answer 9

Data Controllers create and manage sensitive data. Human resource employees are often data controllers. (They create and manage data such as salary and benefit data).

Question 10

What is a Data Processor?

Answer 10

Data Processors manage data on behalf of data controllers. An outsourced payroll company is an example of a data processor. They manage payroll data on behalf of the data controller, such as the HR department.

Question 11

How much sensitive information should an organization collect?

Answer 11

Organizations should collect the minimum amount of sensitive information that is required.