CC6 - Chapter 6

Question 1

• : Organizations must recognize the privacy and confidentiality needs of their stakeholders. Yung mga stakeholders na yon is yung mga clients, patients, students, citizens, suppliers, or business partners. Everyone in an organization must be a responsible trustee of their stakeholders’ data.

Answer 1

Stakeholders

Question 2

• : are in place to protect the interests of some stakeholders. Regulations have different goals. Some restrict access to information, while others ensure openness, transparency, and accountability.

Answer 2

Government regulations

Question 3

• : Each organization has their own data to protect. An organization’s data provides insight into its customers and, when used effectively, can provide a competitive advantage. If confidential data is stolen or breached, an organization can lose competitive advantage.

Answer 3

Proprietary business concerns

Question 4

• : When securing data, organizations must also enable legitimate access. Business processes require individuals in certain roles be able to access, use, and maintain data.

Answer 4

Legitimate access needs

Question 5

• : Contractual and non-disclosure agreements also influence data security requirements. For example, the PCI Standard, an agreement among credit card companies and individual business enterprises, demands that certain types of data be protected in defined ways (e.g., mandatory encryption for customer passwords).

Answer 5

Contractual obligations

Question 6

includes attaining and sustaining operational business goals. Data security issues, breaches, and unwarranted restrictions on employee access to data can directly impact operational success.

Answer 6

Business growth

Question 7

are the primary drivers of data security activities. Ensuring that an organization’s data is secure reduces risk and adds competitive advantage. Security itself is a valuable asset.

Answer 7

Risk reduction and business growth

Question 8

: Depending on the industry and organization, there can be few or many assets, and a range of sensitive data (including personal identification, medical, financial, and more).

Answer 8

Identify and classify sensitive data assets

Question 9

: The measures necessary to ensure security can vary between assets, depending on data content and the type of technology.

Answer 9

Determine how each asset needs to be protected

Question 10

: Analysis of business processes is required to determine what access is allowed and under what conditions.

Answer 10

Identify how this information interacts with business processes

Question 11

definition, planning, development and execution of security policies and procedures to provide proper authentication, authorization, access, and auditing of data and information assets

Answer 11

data security

Question 12

• : Data Security is a collaborative effort involving IT security administrators, data stewards/data governance, internal and external audit teams, and the legal department.

Answer 12

Collaboration

Question 13

• : Data Security standards and policies must be applied consistently across the entire organization.

Answer 13

Enterprise approach

Question 14

• : Roles and responsibilities must be clearly defined, including the ‘chain of custody’ for data across organizations and roles.

Answer 14

Clear accountability

Question 14

• : Success in data security management depends on being proactive and dynamic, engaging all stakeholders, managing change, and overcoming organizational or cultural bottlenecks such as traditional separation of responsibilities between information security, information technology, data administration, and business stakeholders.

Answer 14

Proactive management

Question 15

is a weaknesses or defect in a system that allows it to be successfully attacked and compromised – essentially a hole in an organization’s defenses. Some vulnerabilities are called exploits.

Answer 15

vulnerability

Question 16

• : Security classification for data elements is an essential part of data definitions.

Answer 16

Metadata-driven

Question 16

• : Minimize sensitive/confidential data proliferation, especially to non-production environments.

Answer 16

Reduce risk by reducing exposure

Question 17

is a potential offensive action that could be taken against an organization. Threats can be internal or external. They are not always malicious. An uniformed insider can take offensive actions again the organization without even knowing it. Threats may relate to specific vulnerabilities, which then can be prioritized for remediation. Each threat should match to a capability that either prevents the threat or limits the damage it might cause. An occurrence of a threat is also called an attack surface.

Answer 17

threat

Question 18

• Probability that the threat will occur and its likely frequency
• The type and amount of damage created each occurrence might cause, including damage to reputation

Answer 18

Risk

Question 19

describe the sensitivity of the data and the likelihood that it might be sought after for malicious purposes. Classifications are used to determine who (i.e., people in which roles) can access the data. The highest security classification of any datum within a user entitlement determines the security classification of the entire aggregation.

Answer 19

Risk classifications

Question 20

• Personal information aggressively sought for unauthorized use by both internal and external parties due to its high direct financial value. Compromise of CRD would not only harm individuals, but would result in financial harm to the company from significant penalties, costs to retain customers and employees, as well as harm to brand and reputation.

Answer 20

Critical Risk Data (CRD):

Question 21

• : is actively sought for unauthorized use due to its potential direct financial value. it provides the company with a competitive edge. If compromised, it could expose the company to financial harm through loss of opportunity. Loss of HRD can cause mistrust leading to the loss of business and may result in legal exposure, regulatory fines and penalties, as well as damage to brand and reputation.

Answer 21

High Risk Data (HRD)

Question 22

• : Company information that has little tangible value to unauthorized parties; however, the unauthorized use of this non-public information would likely have a negative effect on the company.

Answer 22

Moderate Risk Data (MRD)

Question 22

: `Enable individuals with authorization to access systems in a timely manner`. Used as a verb, access means to actively connect to an information system and be working with the data. Used as a noun, access indicates that the person has a valid authorization to the data.

Answer 22

**Access**

Question 22

* : `Review security actions and user activity to ensure compliance with regulations and conformance with company policy and standards`. Information security professionals periodically review logs and documents to validate compliance with security regulations, policies, and standards. Results of these audits are published periodically.

Answer 22

**Audit**

Question 23

* : `Validate users’ access`. When a user tries to login to a system, the system needs to verify that the person is who he or she claims to be. Passwords are one way of doing this. More stringent authentication methods include the person having a security token, answering questions, or submitting a fingerprint. All transmissions during authentication are encrypted to prevent theft of the authenticating information.

Answer 23

**Authentication**

Question 24

* : `Grant individuals privileges to access specific views of data, appropriate to their role.` After the authorization decision, the Access Control System checks each time a user logs in to see if they have a valid authorization token. Technically, this is an entry in a data field in the corporate Active Directory indicating that the person has been authorized by somebody to access the data. It further indicates that a responsible person made the decision to grant this authorization because the user is entitled to it by virtue of their job or corporate status.

Answer 24

**Authorization**

Question 25

In security, it is the state of being whole – protected from improper alteration, deletion, or addition. For example, in the U.S., Sarbanes-Oxley regulations are mostly concerned with protecting financial information integrity by identifying rules for how financial information can be created and edited.

Answer 25

**data integrity**

Question 25

Systems should include monitoring controls that detect unexpected events, including potential security violations. Systems containing confidential information, such as salary or financial data, commonly implement active, real-time monitoring that alerts the security administrator to suspicious activity or inappropriate access.

Answer 25

**monitoring**

Question 25

* : is the `sum total of all the data elements that are exposed to a user by a single access authorization decision`. A responsible manager must decide that a person is ‘entitled’ to access this information before an authorization request is generated. An inventory of all the data exposed by each entitlement is necessary in determining regulatory and confidentiality requirements for Entitlement decisions.

Answer 25

**Entitlement**

Question 26

is the `process of translating plain text into complex codes to hide privileged information, verify complete transmission, or verify the sender’s identity.` Encrypted data cannot be read without the decryption key or algorithm, which is usually stored separately and cannot be calculated based on other data elements in the same data set. There are four main methods of encryption – hash, symmetric, private-key, and public-key – with varying levels of complexity and key structure.

Answer 26

**Encryption**

Question 27

encryption `uses algorithms to convert data into a mathematical representation`. The exact algorithms used and order of application must be known in order to reverse the encryption process and reveal the original data. Sometimes hashing is used as verification of transmission integrity or identity. Common hashing algorithms are Message Digest 5 (MD5) and Secure Hashing Algorithm (SHA).

Answer 27

**Hash**

Question 28

encryption `uses one key to encrypt the data`. Both the **sender and the recipient must have the key to read the original data.** Data can be encrypted one character at a time (as in a stream) or in blocks. Common private-key algorithms include Data Encryption Standard (DES), Triple DES (3DES), Advanced Encryption Standard (AES), and International Data Encryption Algorithm (IDEA). Cyphers Two fish and Serpent are also considered secure. The use of simple DES is unwise as it is susceptible to many easy attacks.

Answer 28

**Private-key**

Question 29

encryption, the sender and the receiver have different keys. The `sender uses a public key that is freely available, and the receiver uses a private key to reveal the original data`. This type of encryption is useful when many data sources must send protected information to just a few recipients, such as when submitting data to clearinghouses. Public-key methods include Rivest-Shamir-Adelman (RSA) Key Exchange and Diffie-Hellman Key Agreement. PGP (Pretty Good Privacy) is a freely available application of public-key encryption.

Answer 29

**public-key**

Question 29

is useful when `displaying sensitive information on screens for reference`, or creating test data sets from production data that comply with expected application logic.

Answer 29

**Obfuscation**

Question 30

is a type of `data-centric security`. There are two types of data masking, persistent and dynamic. Persistent masking can be executed in-flight or in-place.

Answer 30

**Data masking**

Question 31

`permanently and irreversibly alters the data`. This type of masking is not typically used in production environments, but rather between a production environment and development or test environments. Persistent masking changes the data, but the data must still be viable for use to test processes, application, report, etc.

Answer 31

**Persistent data masking**

Question 32

* `occurs when the data is masked or obfuscated while it is moving between the source (typically production) and destination (typically non-production)environment.` In-flight masking is very secure when properly executed because it does not leave an intermediate file or database with unmasked data. Another benefit is that it is re-runnable if issues are encountered part way through the masking.

Answer 32

**In-flight persistent masking**

Question 33

* is` used when the source and destination are the same`. The unmasked data is read from the source, masked, and then used to overwrite the unmasked data. In-place masking assumes the sensitive data is in a location where it should not exist and the risk needs to be mitigated, or that there is an extra copy of the data in a secure location to mask before moving it to the non-secure location. There are risks to this process. If the masking process fails mid-masking, it can be difficult to restore the data to a useable format. This technique has a few niche uses, but in general, in-flight masking will more securely meet project needs.

Answer 33

**In-place persistent masking**

Question 34

`changes the appearance of the data to the end user or system without changing the underlying data`. This can be extremely useful when users need access to some sensitive production data, but not all of it. For example, in a database the social security number is stored as123456789, but to the call center associate that needs to verify who they are speaking to, the data shows up as ***-**-6789.

Answer 34

**Dynamic data masking**