Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Asset Security > Flashcards

Asset Security Flashcards

(63 cards)

Start Studying
1
Q

Information lifecycle

A

classification
categorization
ownership
maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Asset classification

A

asset is anything that has value to an org
Tangible (h/w,s/w,firmware, n/w device )
Intangible (information, data, trademark,copyright, patent, IP, image, reputation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Product life cycle :
EOL (end of life),
EOS (End of support)

A

EOS - no longer supported y vendor (sunsetting)
EOL - no longer sold by vendor but support may still be available)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Info systems lifecycle (8 phases) -
NIST SP 800 - 160

A

Stakeholders requirements
Analysis
Architectural design
Development/implement
Integration
Verification/Validation
Transition/deployment
Operate and maintenance
Retirement/disposal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data Classification

A
  1. Controlled Information:
    PII - Personally identifiable information
    PHI - protected healthcare information
    CHD - card holder data
  2. Intellectual Property
  3. Financial data
  4. Others such as HR data, sensitive emails n texts, security reports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Data Classification Labels

A

Top secret : highest level - exceptional grave damage
secret : serious damage
confidential : damage
sensitive , but unclassified (SBU) : doesn’t cause damage
Unclassified : doesn’t violate confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Commercial terms - classification labels

A

Public, official use only, internal use only, and company proprietary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Most critical data

A

credit cards
financial information
healthcare data
customer PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

data classification criteria

A

Value : info worth to the company
Age : how current is the info, does org need 5yr old data
Useful life: at what point is data in your sys no longer worth protecting
Personal association: medical records, case files, personnel files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Distribution of classified information

A

Court orders/legal mandates such as FOIA requests release of info that would otherwise remain protected

FOIA - Freedom of info act

Management can approve distribution of classified info outside of the org, in conjunction with NDA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Regulated data-based classification

A

PHI
- associated with HIPAA
PII
- name, address, SSN, DOB, license
CHD
- cc number
- cardholder name
-exp date
- CVV
- PCI DSS - payment card industry data security standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Data Ownership

A

Business/Mission Owner
Data/Information Owner
System Owner
Custodians
Users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Business/Mission Owner

A

Responsible for the success of an org
high ranking officials are responsible for establishment of an orgs computer security prg n goals
set priorities to support the mission of the org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data Owner

A

Member of mgmt
corporate responsibility for protection of specific data
take into consideration laws, policies, regulations, budget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

System Owner - NIST 800-18

A

responsible for the comp system (h/w n s/w)
Focus on system design, plan n updates
hands on responsibilities (patching, backup) are delegated to custodians

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Custodian

A

Perform hands on activities to achieve data protection requirements dictated by data owners

not decision makers

actions taken will be in accordance with policy, procedure, / owner approved changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

User

A

Individuals who have been granted access to, n leverage data during the course of their function

operate within bounds of AUP helps to ensure data security is maintained

responsible to report security incidents that they are aware of

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Sensitive data collection limitation

A

OECD - Org for economic cooperation n development directly addresses collection limitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Data controllers and processors

A

Controllers: Org that creates /manages sensitive data
eg: salary data managed by HR dept

Processors: 3rd party companies that access an org’s sensitive data
eg: outsourced payroll company

data controller bears the legal responsibility that the processor actually implements the necessary security measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data retention policies

A

Determine how long specific types of data should be retained by the org
ESI - Electronically stored info destroyed as per data retention/destruction policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Records retention issues : email

A

Orgs should purge email after the retention period has expired

also consider local archives (pst files) - personal storage table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Object reuse

A

concept of reusing storage media after its initial use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Data Remanence

A

Info that persists on media after attempted removal
Remnants might only be accessible with forensic tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Media Storage

A

Paper printouts
Data backup tapes
CDs
Diskettes
Hard drives
Flash drives

storage ares: onsite, offsite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Data storage and memory terms
Real, main or primary memory Secondary memory WORM - Write once, read many Volatile storage non-volatile storage
26
Sequential access memory/storage Random access
Storage devices that are read and written to in a sequential order older n slow technology used by magnetic tapes Random access: that allow for jumping to a location n reading/writing of data faster technology n more complex
27
Real/primary memory
uses RAM Data storage that is directly accessible by CPU volatile higher speed data retrieval consists of registers, SRAM, DRAM Data lost when power is lost
28
Registers, SRAM, DRAM
Registers: small storage locations used by the CPU to store instructions n data located within CPU fastest of all RAM SRAM - Static RAM Very fast, less amount, used for cache memory more expensive than DRAM DRAM - Dynamic RAM Refreshed on a regular basis cheapest n most common
29
Volatile and non-volatile storage
volatile: Registers, SRAM, DRAM power lost data lost non-volatile: secondary storage like hard drives, firmware also non-volatile not able to be directly accessed by CPU Slower retrieval
30
ROM, Firmware
ROM:Non-volatile allows system to be booted Firmware : stored on a type of ROM Chip maintained on non-volatile storage firmware is generally the controlling s/w for a device that is placed in special type of ROM
31
Types of ROM
PROM EPROM EEPROM PLD
32
Media Sanitization
Controlling access to media proper disposal of media sanitising media: --removing data -- wiping/overwriting --degaussing - applying large magnetic field to erase magnetic media -- Destruction
33
Media sanitisation methods: clear, purge, Destroy
security categorisation high - destroy medium - purge
34
Media Sanitization Methods : Clear
data is overwritten clearing is done locally data is not recoverable via the device interface
35
Media Sanitization Methods : Purge
bypass the computers OS to securely remove data purge ensures that no data is recoverable eg: firmware level erase cryptographic erase (CE) degaussing
36
Media Sanitization Methods : Destroy
The storage device rendered unusable these methods are designed to completely destroy media eg: methods include Disintegrate (separating into component parts) Pulverize (act of grinding to a dust/powder) Melt ( solid to liquid state) Incinerate (burning to ashes) Shred: paper shredders to destroy flexible media such as diskettes
37
Flash memory and SSD Remanence
Flash memory is based on EEPROM tech SSDs use a combination of flash memory n DRAM Degaussing has no effect on EEPROM The remanence properties of EEPROM, and flash memory are different from RAM/physical media
38
Options for erasing flash drives and SSDs
use encryption, never store unencrypted data 2 common options if uncrypted data -- use ATA secure erase -- physically destroy the device physical destruction is more expensive but more secure
39
Prepare the media for reuse (processes)
Erasing, clearing and overwriting if used in the same classification env Purging , sanitizing, degaussing if media used in different classification env
40
Goals of managing backup media
preventing disclosure, destruction, and alteration of data
41
Provisioning
deals with preparing a user, service, system for active deployment provisioning ends with the instantiation of the user, service, or system into the operational status security baseline and configuration mgmt are key principles in the provisioning phase
42
WORM media remanence
WORM media commonly used for legal purposes provides integrity assurance worm media -CD-R, DVD-R Destruction is the best method, others no effect
43
Config mgmt
security config mgmt is a fundamental security principle
44
PoLP
Min necessary achieving min necessary is much more difficult than it sounds
45
Baseline security
start with free guidance 1. CIS - Center for internet security - includes OS gudes, server, app guides 2. Microsoft Security guides 3. NIST SP800s 4. DISA STIGs - security technical implementation guides from the defence info systems agency --for US DoD
46
Security Metrics
provide meaningful security data helps an org to understand threats n vulns helps to make better decisions related to security
47
Continuous monitoring and improvement
leads to continuous posture improvements
48
Best practices and standards
adhere to industry accepted best practices standards: ISO : International organization for standardization NIST : national institute of standards n technology IETF:internet engineering task force
49
ISO
Grouped as 27000 series ISO 27001 - (Auditing) provides security requirements , used for 3rd party verification/attestation ISO 27002 (Best Practices)- Most popular providing guidance on security
50
SABSA
Sherwood applied business security architecture open source n vendor neutral framework for enterprise security architecture maintained by non profit SABSA institute
51
COBIT - 5 domains
Evaluate , Direct and Monitor (EDM) Align, plan and organize (APO) Build, acquire and Implement (BAI) Deliver, Service n support (DSS) Monitor , Evaluate and Assess (MEA)
52
COBIT
Control objectives for information and related technology COBIT provides guidance in the enterprise governance of information and technology (EGIT) COBIT 2019 defines40 governance n mgmt objectives across 5 domains
53
NIST 800 Series SP
The US national institute of standards and technology issues best practice publications - 800 series of SP (Special publications) NIST 800-34 : contingency planning NIST 800-37 : risk mgmt NIST 800-53 recommended security controls NIST 800-115: Security testing and assessment NIST 800-18 (Security plans)
54
IETF (internet standards)
The internet engineering task force focus on internet standards IETF manages requests for comments (RFC) RFCs are internet standards documents
55
Scoping , Tailoring,
Scoping: determining applicable portions of standards that will be followed eg: org that doesnt use wireless networks declares wireless security controls out of scope Tailoring: customizes a standard for an irg
56
DLP
DLP Attempts to prevent n detect unauthorized exfiltration of data from systems n networks 1. Host based solutions (at rest) - use DLP agents 2. Storage based DLP Solutions(at rest) 3. Network based DLP Solutions(in transit) 4. Cloud based DLP Solutions protect all 3 (rest, in use), transit)
57
Data States
at rest : stored on disk, tapeUSB, in firmware in transit : data being transferred across a network in use : data being actively accessed inside an app controls : DLP (Data loss prevention) can protect data in all three states
58
Storage based DLP
Used on SANs (storage area network) and NAS (network attached storage) and cloud based storage
59
network based DLP
Packet sniffers, nextgen firewalls, email based solutions
60
Digital rights mgmt (DRM)
Is a suite of technologies designed to protect copyrighted digital media eg: ebooks, games, music, movies etc
61
Pillars of CASB
Visibility Data Security Threat protection Compliance
62
CASB (Cloud access security broker)
provides cloud security connection/enforcement points eg: nextgen firewalls, WAF CASB may be used to provide - authentication (SSO) -Authorization -DLP -Malware detection n prevention -Logging, alerting etc
63
DRM Controls
preventing editing n saving preventing forwarding n sharing preventing printing ( or limiting the no of prints) preventing screen grabbing document expiry document revocation locking docs to devices , IP Addresses and country locations watermarking docs with unique user info to establish an identity

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions