KAS Flashcards
NIST Special Publication – defines PII as any information that can be used to trace a person’s identity such as SSN, name, DOB, place of birth, mother’s maiden name
800-122
build/implement info security continuous monitoring program: define, establish, implement, analyze and report
800-137
GAPP for securing information technology systems
800-14
cloud computing
800-145
How to develop security plans
800-18 NIST
Baseline for achieving security, five lifecycle planning phases (defined in 800-14), 33 IT security principles
800-27
NIST guidelines for sanitation and disposition, prevents data remanence
800-88
Assign permission to access and handle data
Administrators
examines security controls
Auditor
Starting point that can be tailored to an organization for a minimum security standard. Common security configurations, Use Group Policies to check and enforce compliance
Baseline
value of data exceeds cost of media; Sanitation is business normal, not destruction for costs reasons
Buy high quality media
a class of media on which data are recorded by optical means.
CD
Compact Disc
creates list of security controls for OS, mobile, server, and network devices
CIS
Center for Internet Security
costs are not a factor in classifying data but are in controls
Classifying Costs
To use software or hardware products to overwrite storage space on the media with non- sensitive data. This process may include overwriting not only the logical storage location of a file(s) (e.g., file allocation table) but also may include all addressable locations.
Clear
See comments on clear/purge convergence.
z-Prepping media for reuse at same level. Removal of sensitive data from storage devices in such a way that the data may not be reconstructed using normal system functions or utilities. May be recoverable with special lab equipment. Data just overwritten.
Clearing
operators of commercial websites post a privacy policy if collecting personal information on CA residents
COPPA, California Online Privacy Protection Act
Value, age, useful life, personal association
Criteria
Critical point where a material’s intrinsic magnetic alignment changes direction.
Curie Temperature
Pieces of information from which “understandable information” is derived
Data
Dar; inactive data that is physically stored, not RAM, biggest threat is a data breach, full disk encryption protects it (Microsoft Bitlocker and Microsoft EFS, which use AES, are apps)
Data at rest
Creation, use, destruction (subservient to security policy)
Data Life
To reduce the magnetic flux to virtual zero by applying a reverse magnetizing field. Also called demagnetizing.
Degauss
Degaussing any current generation hard disk (including but not limited to IDE, EIDE, ATA, SCSI and Jaz) will render the drive permanently unusable since these drives store track location information on the hard drive in dedicated regions of the drive in between the data sectors.
AC erasure; alternating magnetic fields , DC erasure; unidirectional magnetic field or permanent magnet, can erase tapes
Degaussing
The result of actions taken to ensure that media cannot be reused as originally intended and that information is virtually impossible to recover or prohibitively expensive.
Destruction
The binary coding scheme generally used in computer technology to represent data as binary bits (1s and 0s).
Digital
A physically destructive method of sanitizing media; the act of separating into component parts.
Disintegration
The act of discarding media with no other sanitization considerations. This is most often done by paper recycling containing non-confidential information but may also include other media.
Disposal
use labels to determine the appropriate control to apply to data. Won’t modify labels in real-time.
DLP
Data Loss/Leakage Prevention
establishes DIACAP
DOD 8510.01
a disc the same shape and size as a CD; but the ? has a higher density and gives the option for data to be double-sided or double-layered.
DVD
Digital Video Disc
ECM
Enterprise Content Management; centrally managed and controlled
General term that refers to media on which data are recorded via an electrically based process.
Electronic Media
a good way to secure files sent through the internet
Encrypt data
You can see ALL BUT PAYLOAD, normally done by users
End to End
Uses information as their job
Follows instructions in policies and guidelines
Due care (prevents open view by e.g. Clean desk)
Use corporation resources for corporation use
End user
deletion of files or media, removes link to file, least effective
Erasing
Process intended to render magnetically stored information irretrievable by normal means.
Erasure
official series of publications relating to standards and guidelines adopted under the FISMA, Federal Information Security Management Act of 2002.
FIPS, Federal Information Processing Standards;
Standards for categorizing information and information systems.
FIPS 199
minimum security requirements for Federal information and information systems
FIPS 200
Pre-established layout for data.
Format
z-overseas compliance framework for organizations wishing to use personal data of EU citizens
Self-certify but Dpt. Of Transportation or ? can enforce
Gramm/Leach/Bailey Act delaying application to financial markets
FTC
FTP and Telnet are unencrypted!
SFTP and SSH provide encryption to protect data and credentials that are used to log in
A rigid magnetic disk fixed permanently within a drive unit and used for storing data.
Hard Disk
A physically destructive method of sanitizing media; the act of burning completely to ashes.
Incineration
Meaningful interpretation or expression of data.
Information
classifications and defines level of access and method to store and transmit information
Information policy
Metadata of subject (its classification) or object (its clearance) relating to the operational processes of mandatory access control systems .
Label
to make sure data is identifiable by its classification level. Some label all media that contains data to prevent reuse of Public media for sensitive data.
Label Data
z-is usually point to point EVERYTHING ENCRYPTED
“Black pipe, black oil, black ping pong balls” all data is encrypted, normally did by service providers
Link
act of identifying that material is classified but not revealing the classification; no label is visible.
Marking
Plural of medium.
Media
A general term referring to the actions taken to render data written on media unrecoverable by both ordinary and extraordinary means.
Media Sanitization
Material on which data are or may be recorded, such as paper, punched cards, magnetic tape, magnetic disks, solid state devices, or optical discs.
Medium
A physically destructive method of sanitizing media; to be changed from a solid to a liquid state generally by the application of heat.
Melting
NIST
National Institute of Standards and Technology
z-special publications address computer security in a variety of areas
NIST SP 800 series
z-legal agreement that prevents employees from sharing proprietary information
Non-disclosure Agreement
A plastic disk that is “written” (encoded) and “read” using an optical laser device.
Optical Disks
Writing patterns of data on top of the data stored on a magnetic medium.
Overwrite
NSA has researched that one overwrite is good enough to sanitize most drives. See comments on clear/purge convergence.
z-overwrites with pattern, may miss
Overwriting wiping shredding
credit cards, provides a set of security controls /standards
PCI-DSS
Payment and Card Industry – Security Standards Council;
Deals with the knowledge that employees gain while employed.
Personnel Retention
A sanitization method for optical media, such as CDs.
Physical Destruction
A physically destructive method of sanitizing media; the act of grinding to a powder or dust.
Pulverization
Rendering sanitized data unrecoverable by laboratory attack methods. See comments on clear/purge convergence.
Purge
More intense than clearing. Media can be reused in lower systems. Removal of sensitive data with the intent that the data cannot be reconstructed by any known technique.
Purging
assessment of quality based on standards external to the process and involves reviewing of the activities and quality control processes.
QA
assessment of quality based on internal standards
QC
Fundamental process in an information system that results only in the flow of information from an object to a subject.
Read
To write data on a medium, such as a magnetic tape, magnetic disk, or optical disc.
Record
retaining and maintaining information for as long as it’s needed
Record Retention
how long data retained and maintained
Record Retention Policies
Action necessary to store data files of an information system and computational capability after a system failure.
Recovery Procedures
Residual information remaining on storage media after clearing.
Remanence
use strong encryption, like AES256, to ensure loss of media does not result in data breach
Removable Media
Data left in storage after information processing operations are complete, but before degaussing or overwriting has taken place.
Residue
Downgrading equipment for reuse will probably be more expensive than buying new
Reuse
Generally a commercially available disc or solid state device on which the content was recorded during the manufacturing process.
ROM
Read Only Memory
Process to remove information from media such that data recovery is not possible. It includes removing all classified labels, markings, and activity logs.
Sanitize
Series of processes that removes data, ensures data is unrecoverable by any means. Removing a computer from service and disposed of. All storage media removed or destroyed.
Sanitizing
reviewing baseline security controls and selecting only those controls that apply to the IT system you’re trying to protect.
Scoping
An overwrite technology using firmware based process to overwrite a hard drive. Is a drive command defined in the ANSI ATA and SCSI disk drive interface specifications, which runs inside drive hardware. It completes in about 1/8 the time of 5220 block erasure.
Secure Erase
Strategic, develops policies and guidelines
Security Analyst
involves security scope, providing security management responsibilities and testing security measures for effectiveness. Strategic 5 years Tactical shorter than strategic Operational day to day, short term
Security planning
authenticates and defines technology used to control information access and distribution
Security policies
ultimate responsibility
Senior Manager
A method of sanitizing media; the act of cutting or tearing into small particles.
Shred
Specify use of specific technologies in a uniform way
Standards
Retrievable retention of data. Electronic, electrostatic, or electrical hardware or other elements (media) into which data may be entered, and from which data may be retrieved.
Storage
adding assessment procedures or assessment details to adequately meet the risk management needs of the organization.
Supplementation
Select security controls
System Owners
lists hardware / software to be used and steps to undertake to protect infrastructure
SYSTEM security policy
modifying the list of security controls within a baseline so that they align with the mission of the organization.
Tailoring
WORM
Write-Once Read Many.
wipe a drive and fill with zeros
Zero fill
exculpatory
evidence that is favorable to defendant, tends to exonerate
inculpatory
evidence that shows guilt
colocation cloud
Colocation cloud combines the benefits of colocation and cloud computing to provide a comprehensive solution that addresses the limitations of traditional data management approaches.
blue team
defends from attacks
red team
attacks
white team
handles security incidents
