Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISSP > Asset Security > Flashcards

Asset Security Flashcards

(74 cards)

Start Studying
1
Q

VALUE OF ASSETS

A

Qualitative or

Quantitative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

PROTECTION OF VALUABLE ASSETS

A

SHOULD BE BASED ON VALUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

EXAMPLES OF VALUABLE ASSETS

A

People

Information/data

Hardware

Reputation

Architectures

Software

Products

Processes

Intellectual Property/Ideas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

IDENTIFICATION AND DISCOVERY OF ASSETS

A

Inventory

Needs to be formal process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ASSET CLASSIFICATION

A

Requires management support, commitment, and conviction

Accountability

Policies

Training/awareness/education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

CLASSIFICATION PROCESS

A
  1. Asset inventory
  2. Determine and assign ownership
  3. Classify based on value
  4. Protect and handle based on classification
  5. Reassess (back to step 1)

Ensures information is market in such a way that only those with an appropriate level of clearance can have access to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CATEGORIZATION

A

The process of determining the impact of the loss of confidentiality, integrity, or availability of the information to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ASSET LIFECYCLE

A
  1. Identify and classify
  2. Secure and store
  3. Monitor and log
  4. Recover
  5. Disposition
  6. Archive or
  7. Destruction (defensible)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

EQUIPMENT LIFECYCLE

A
  1. Define requirements
  2. Acquire and implement
  3. Operations and maintenance
  4. Disposal and decommission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CLASSIFICATION VS. CATEGORIZATION

A 
CLASSIFICATION
The act of forming into a class or group
A distribution into groups, as classes according to common attributes

CATEGORIZATION
The process of sorting or arranging things into classes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CLASSIFICATION AND CATEGORIZATION SYSTEMS

A

Canada’s - Security of Information Act

China’s - Guarding State Secrets

UK’s - Official Secrets Act

US NIST’s - Federal Information Processing Standards (FIPS 199)

NIST’s SP800-60 - Guide for Mapping Types of Information and Information Systems to Security Categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

DATA CLASSIFICATION POLICY

A 
Who will have access to data
How the data is secured
How long the data is to be retained
What methods should be used to dispose of data
Whether the data needs to be encrypted
The appropriate use of the data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

EXAMPLES OF CLASSIFICATION LEVELS

A

Top Secret
Company Restricted
Company Confidential
Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

CLASSIFICATION ACTIONS

A

Done by owners

Data owner should decide the classification

Owners should review the classification on a regular basis and adjust it as necessary

Classification should allow for increase or decrease

Changes need to be documented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

PURPOSE OF CLASSIFICATION

A

Ensure that data receive appropriate level of protection

Provide security classifications that will indicate the need and priorities for security protection

Minimize the risks of unauthorized information alteration

Avoid unauthorized disclosure

Maintain competitive edge

Protect legal tactics

Comply with privacy laws, regulations, and industry standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CLASSIFICATION BENEFITS

A

Awareness among employees and customers of in the organization’s commitment to protect the information

Identification of critical information

Identification of vulnerabilities to modification - enable focus on integrity controls

Sensitivity to the need to protect valuable information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ASSETS MANAGEMENT TERMS

A 
DATA SUBJECT
DATA OWNER
DATA CUSTODIAN
DATA STEWARD
PERSONAL DATA
PROCESSING
DATA CONTROLLER
DATA PROCESSOR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DATA OWNERSHIP

A

Accountable for important information security activities surrounding the life-cycle of information to:

Protect it

Ensure it is available to only those who require access

Destroy it when it is no longer needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

INFORMATION OWNER

A

Have broader responsibilities than Data Owners

Responsibilities:

Determine the impact the information has on mission

Understand the replacement cost of the information

Know when the information is no longer accurate, needed , or should be destroyed

Determine who has a need for the information and under what circumstances it should be released

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

DATA CUSTODIAN

A

Deals with consequences of the use of the data and responsible for integrity

Adherence to appropriate and relevant data policies, and procedures, baselines and guidelines

Ensuring accessibility to appropriate users, maintaining appropriate levels of security

Fundamental data maintenance, including but not limited to data storage and archiving

Data documentation, including updates to documentation

Assurance of quality and validation of any additions to data, including supporting periodic audits to ensure ongoing data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

DATA PROTECTION BY ROLE

A

DATA OWNER - Accountable

DATA CONTROLLER - Accountable

DATA CUSTODIAN - Responsible

DATA STEWARD - Responsible

DATA PROCESSOR - Responsible

DATA SUBJECT - Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

SOUND RECORD RETENTION POLICY

A

Train staff

Audit retention and destruction practices

Periodically review policy

Document policy, implementation, training and audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

RECORD RETENTION HINTS

A

Information and data should only be kept as long as it is required (preferably legally required)

Keeping data longer than needed keeps RISK longer than needed

Data is a “snapshot” of information, which si always changing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

ASSET RETENTION BEST PRACTICES

A

Promote cross-functional ownership

Promote cross-functional ownership for archiving, retention, and disposal policies

Plan and practice data retention and orderly disposal

Key areas of focus: media, hardware and personnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
EXAMPLES OF DATA RETENTION POLICIES
European Document retention Guide 2013 State of Florida Electronic Records and Records Management Practices, November 2010 The Employment Practices Code, Information Commissioner's Office, UK, November 2011 Wesleyan University, Information Technology Services Policy Regarding Data Retention for ITS-Owned Systems, September 2013 Visteon Corporation, International Data Protection Policy, April 2013 Texas State Records Retention Schedule (Revised 4th Edition)
26
ESTABLISHING INFORMATION GOVERNANCE AND RETENTION POLICIES
Understand where the data is Classify and define data Archive and manage data
27
EFFECTIVE ARCHIVING AND DATA RETENTION POLICIES
INVOLVE ALL STAKEHOLDERS ESTABLISH COMMON OBJECTIVES FOR SUPPORTING ARCHIVING AND DATA RETENTION BEST PRACTICES WITHIN THE ORGANIZATION MONITOR, REVIEW, AND UPDATE DOCUMENTED DATA RETENTION POLICIES AND ARCHIVING PROCEDURES
28
SOUND RECORD RETENTION POLICY
EVALUATE STATUTORY REQUIREMENTS, LITIGATION OBLIGATIONS AND BUSINESS NEEDS CLASSIFY TYPES OF RECORDS DETERMINE RETENTION PERIODS AND DESTRUCTION PRACTICES DRAFT AND JUSTIFY RECORD RETENTION POLICY TRAIN STAFF AUDIT RETENTION AND DESTRUCTION PRACTICES PERIODICALLY REVIEW POLICY DOCUMENT POLICY, IMPLEMENTATION, TRAINING AND AUDITS
29
DATA QUALITY
DATA CAPTURE AND RECORDING AT THE TIME OF GATHERING DATA MANIPULATION PRIOR TO DIGITIZATION IDENTIFICATION OF THE COLLECTION AND ITS RECORDING DIGITIZATION OF THE DATA DOCUMENTATION OF THE DATA DATA STORAGE AND ARCHIVING DATA PRESENTATION AND DISSEMINATION USING THE DATA
30
DATA QUALITY STANDARDS
ACCURACY PRECISION RESOLUTION RELIABILITY REPEATABILITY REPRODUCIBILITY CURRENCY RELEVANCE ABILITY TO AUDIT COMPLETENESS TIMELINESS
31
Organization for Economic Co-Operation and Development (OECD) PRIVACY GUIDELINES
Collection Limitation Data Quality Purpose Specification Use Limitation Security Safeguards Openness Individual Participation Accountability
32
COLLECTION LIMITATION PRINCIPLE
There should be limits on the collection of data Should be obtained by lawful and fair means With the knowledge and consent of the subject
33
QUALITY CONTROL (QC)
An assessment of the quality based on INTERNAL standards, processes, and procedures established to control and monitor quality.
34
QUALITY ASSURANCE (QA)
An assessment of quality based on standards EXTERNAL to the process and involves reviewing of the activities and quality control processes to ensure final products meet predetermined standards of quality.
35
ASSESSING AND IMPROVING DATA QUALITY
DATA QUALITY DATA VERIFICATION PREVENTION CORRECTION
36
BASELINES
MINIMUM LEVEL OF PROTECTION THAT CAN BE USED AS A REFERENCE POINT.
37
SCOPING
LIMITING THOSE GENERAL BASELINE RECOMMENDATIONS BY REMOVING THOSE THAT DON'T APPLY.
38
TAILORING
ALTERING BASELINE RECOMMENDATIONS TO APPLY MORE SPECIFICALLY SCOPING THE ASSESSMENT PROCEDURES TO MORE CLOSELY MATCH THE CHARACTERISTICS OF THE INFORMATION SYSTEM AND ITS ENVIRONMENT OF OPERATION.
39
BASELINE CATALOGS
INTERNATIONAL AND NATIONAL STANDARDS ORGANIZATIONS INDUSTRY STANDARDS OR RECOMMENDATIONS OTHER COMPANIES IN SIMILAR SECTOR
40
GENERALLY ACCEPTED PRINCIPLES
INFORMATION SYSTEM SECURITY OBJECTIVES PREVENT, DETECT, RESPOND AND RECOVER PROTECTION OF INFORMATION WHILE BEING PROCESSED, IN TRANSIT AND IN STORAGE EXTERNAL SYSTEMS ARE ASSUMED TO BE INSECURE RESILIENCE FOR CRITICAL INFORMATION SYSTEMS AUDITABILITY AND ACCOUNTABILITY
41
LIFE-CYCLE OF NORMAL SYSTEM OPERATION
PREVENT DETECT RESPOND RECOVER
42
WHERE TO PROTECT DATA
IN PROCESS IN TRANSIT IN STORAGE
43
RESILIENCE
ABILITY TO RETURN TO A KNOWN SET OF NORMAL OPERATIONS - WHEN ABNORMAL OPERATIONS ARE DETECTED.
44
CSIS 20 CRITICAL SECURITY CONTROLS INITIATIVE
OFFENSE INFORMS DEFENSE PRIORITIZATION METRICS CONTINUOUS MONITORING AUTOMATION
45
NIST SECURITY CONTENT AUTOMATION PROTOCOL (SCAP)
SUITE OF SPECIFICATIONS MULTI-PURPOSE FRAMEWORK OF SPECIFICATIONS
46
SCAP VERSION 1.2 CATEGORIES
LANGUAGES REPORTING FORMATS ENUMERATIONS MEASUREMENT AND SCORING SYSTEMS INTEGRITY
47
FRAMEWORK CORE COMPONENTS
FRAMEWORK CORE IS A SET OF CYBER-SECURITY ACTIVITIES, DESIRED OUTCOMES, AND APPLICABLE REFERENCES THAT ARE COMMON ACROSS CRITICAL INFRASTRUCTURE SECTORS. FRAMEWORK IMPLEMENTATION TIERS FRAMEWORK PROFILE
48
DATA STATES
DATA AT REST DATA IN MOTION DATA IN USE
49
DATA AT REST
BACKUP DATA OFFSITE STORAGE PASSWORD FILES OTHER SENSITIVE INFORMATION USUALLY PROTECTED VIA CRYPTOGRAPHIC ALGOS
50
DATA AT REST RECOMMANDATIONS
IMPLEMENT CONTROLS SUCH AS ENCRYPTION, ACCESS CONTROL AND REDUNDANCY DEVELOP AND TEST AN APPROPRIATE DATA RECOVERY PLAN USE COMPLAINT ENCRYPTION ALGOS WHENEVER POSSIBLE USE AES FOR ENCRYPTION ALGOS DUE TO SPEED AND STRENGTH FOLLOW STRONG PASSWORD REQUIREMENTS DO NOT USE THE SAME PASSWORD FROM OTHER SYSTEMS USE SECURE PASSWORD MANAGEMENT TOOLS TO STORE SENSITIVE INFORMATION SUCH AS PASSWORDS AND KEYS SEND PASSWORDS SEPARATELY FROM ENCRYPTED FILE DO NOT WRITE DOWN PASSWORD AND DO NOT STORE AT SAME LOCATION AS STORAGE MEDIA VERIFY THAT REMOVABLE MEDIA WORKS USING DECRYPTION DELETE USING DELETION GUIDELINES REMOVABLE MEDIA SHOULD BE LABELED WITH TITLE, DATA OWNER AND ENCRYPTION DATE
51
DATA IN TRANSIT PROTECTIONS
PREVENT THE CONTENTS OF THE MESSAGE FROM BEING REVEALED EVEN IF THE MESSAGE WAS INTERCEPTED OR IN TRANSIT (EMAIL)
52
DATA IN TRANSIT
DATA THAT MOVES - USUALLY ACROSS NETWORKS IS IN MOTION OR IN TRANSIT
53
LINK ENCRYPTION
ENCRYPTS ALL DATA ALONG A COMMUNICATIONS PATH - USUALLY DONE BY SERVICE PROVIDERS
54
END-TO-END ENCRYPTION
DATA IS ENCRYPTED AT START OF TRANSMISSION AND ONLY DECRYPTED AT THE REMOTE END ROUTING INFORMATION REMAINS VISIBLE
55
DATA IN USE
DATA BEING PROCESSED NEEDS TO BE PROTECTED BY SECURE ENCLAVES (LAYERS OR VIRTUAL MACHINES)
56
ENCLAVE
TERRITORY THAT IS ISOLATED OR DISTINCT FROM ANOTHER TERRITORY.
57
INSECURE AND SECURE PROTOCOLS
TYPE INSECURE SECURE Web Access HTTP HTTPS File Transfer FTP, RCP FTPS, SFTP, SCP Remote Shell telnet SSH v3 Remote Desktop VNC radmin, RDP
58
PICKING ENCRYPTION ALGOS
The longer the key the better with complex passwords
59
PICKING WIRELESS ENCRYPTION PROTOCOLS
ONLY STRONG ALGOS LIKE WPA2
60
MEDIA
Media with sensitive information requires physical and logical controls Media lacks means for digital accountability when the data is not encrypted Extensive care must be taken when handling sensitive media ENCRYPTION DOESN'T ENSURE ACCOUNTABILITY
61
MARKING
Storage media must have: Physical Label with sensitivity contained Label should reflect if data is encrypted Label may contain point of contact and retention period When media is found without label it should be labeled at the highest sensitivity until identified
62
HANDLING
Only designated personnel with sensitive media Policies and procedures regarding proper handling of sensitive media should be communicated Individuals handling the media should be trained on policies and procedures
63
STORING
Sensitive media should not be left lying around where a passerby could access it Wherever possible backup media should be encrypted and stored in a container
64
DESTRUCTION
Media that is no longer needed or is defective should be defensively destroyed rather than simply disposed of.
65
RECORD OF RETENTION
Information and data should only be kept as long as it's required Ensure that: The organization understands the retention requirements for different types of data in the organization The organization documents in a record's schedule the retention requirements for each type of information The systems, processes and individuals of the organization retain information in accordance with the schedule but no longer
66
DATA REMANENCE
The residual physical representation of the data that has been in some way erased After media is erased there may be some physical characteristics that allow data to be reconstructed
67
DATA REMANENCE COUNTERMEASURES
Clearing Purging Destruction
68
CLEARING
The removal of sensitive data from storage devices so there is assurance that the data may not be reconstructed using normal system function or software file/data recovery utilities The data may still be recoverable - but not without special laboratory techniques
69
PURGING
The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique
70
DESTRUCTION
The storage media is made unusable for conventional equipment Effectiveness of destroying the media varies Destruction using appropriate techniques is the most secure method of preventing retrieval and referred to as "defensible destruction"
71
DATA DESTRUCTION METHODS
OVERWRITING DEGAUSSING ENCRYPTION
72
DEFENSIBLE DESTRUCTION
Physically breaking the media apart Chemically altering the media into non-readable, non-reverse-constructible state Phase transition For magnetic media, raising its temperature above the Curie Temperature
73
SOLID-STATE DRIVE (SSD) DESTRUCTION
SSD's use flash memory for data storage and retrieval Flash memory differs from magnetic memory in one key way: flash memory cannot be overwritten Unlike HDD's - overwriting is not effective for SSD's Cryptographic erasure, or crypto-erase, takes advantage of the SSD's built-in data encryption The best type of data destruction method is a combination of crypto-erase, sanitization, and targeted overwrite passes
74
CLOUD-BASED DATA REMANENCE
Little to no visibility in to the management and security of the data in many cases PaaS-based architecture can actually provide a solution for the issues raised by the data remanence in the cloud Crypto-Erase/Crypto Shredding can work

CISSP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions