Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP Domains 1-8 > Chapter 5 (Domain 2: Asset Security) > Flashcards

Chapter 5 (Domain 2: Asset Security) Flashcards

1
Q

First steps in Asset Security

A

Identifying and classifying information and assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Sensitive data

A

Any information that isn’t public or unclassified such as confidential, proprietary, protected, or any other type of data that an organization needs to protect due to its value to the organization, or to comply with existing laws and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

PII

A

Personally identifiable information (PII) is any information that can identify an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

PHI

A

Protected health information (PHI) is any health-related information that can be related to a specific person

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

HIPAA

A

Health Insurance Portability and Accountability Act (HIPAA) mandates the protection of PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Proprietary data

A

Any data that helps an organization maintain a competitive edge such as software code it developed, technical plans for products, internal processes, intellectual property, or trade secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Data classification

A

Identifies the value of the data to the organization and is critical to protect data confidentiality and integrity. Included in a security policy or data policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

US government data classification

A

Top secret
Secret
Confidential
Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Non-government data classification

A

Confidential/Proprietary
Private
Sensitive
Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Sensitive information

A

Any information that isn’t public or unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Asset classification

A

Asset classifications should match the data classifications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What comes after Data Classification?

A

Define the security requirements and identify security controls to implement those security requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the best way to protect the confidentiality of data?

A

Strong encryption protocols, authentication and authorization controls help prevent unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data breach

A

Any event in which an unauthorized entity can view or access sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the most important information that a mark or label provides? (Marking or Labeling)

A

Classification of the data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Example of Marking or Labeling

A

Digital marks or labels, header or footer in a document, embed as a watermark

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How is downgrading media handled?

A

Requires procedures that will purge the tape of all usable data.
Many organizations prohibit downgrading media at all.
It is rare to downgrade a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How is physical media stored?

A

Devices in locked safes or vaults and/or within a secure room that includes several additional physical security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How is sensitive data handled when no longer needed?

A

Should be destroyed when no longer needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How are acceptable methods of destroying data defined?

A

An organization’s security policy or data policy should define the acceptable methods of destroying data based on the data’s classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is data remanence?

A

Data remanence is the data that remains on media after the data was supposedly erased. It typically refers to data on a hard drive as residual magnetic flux

22
Q

How can data remanence be removed?

A

A degausser generates a heavy magnetic field, which realigns the magnetic fields in magnetic media such as traditional hard drives, magnetic tape, and floppy disk drives

23
Q

What is a degausser?

A

A degausser generates a heavy magnetic field, which realigns the magnetic fields in magnetic media such as traditional hard drives, magnetic tape, and floppy disk drives. Only effective on magnetic media.

24
Q

How should SSDs be handled?

A

The best method of sanitizing SSDs is destruction since built-in erase commands are not effective.

25
Q

What is the best way to sanitize SSDs?

A

The best method of sanitizing SSDs is destruction

26
Q

What is erasing data?

A

Erasing media is simply performing a delete operation against a file, a selection of files, or the entire media-

27
Q

What is clearing data?

A

Clearing, or overwriting, is a process of preparing media for reuse and ensuring that the cleared data cannot be recovered using traditional recovery tools by overwriting with unclassified data

28
Q

What is purging?

A

Purging is a more intense form of clearing that prepares media for reuse in less secure environments. It provides a level of assurance that the original data is not recoverable using any known methods. A purging process will repeat the clearing process multiple times and may combine it with another method such as degaussing to completely remove the data.

29
Q

What is the most secure method of sanitizing media?

A

Destruction is the most secure method of sanitizing media.

30
Q

What is record retention or media retention?

A

Record retention involves retaining and maintaining important information as long as it is needed and destroying it when it is no longer needed.

31
Q

How is record retention defined?

A

An organization’s security policy or data policy typically identifies retention timeframes.

32
Q

What happens when there is no retention policy?

A

May delete data earlier than expected or keep data indefinitely

33
Q

What is bcrypt?

A

Linux systems use bcrypt to encrypt passwords.
Bcrypt is based on Blowfish
Bcrypt adds 128 additional bits as a salt to protect against rainbow table attacks.

34
Q

What is Blowfish?

A

Bruce Schneier developed Blowfish as a possible alternative to DES.
It can use key sizes of 32 bits to 448 bits and is a strong encryption protocol

35
Q

Symmetric encryption

A

Uses the same key to encrypt and decrypt data

36
Q

Examples of Symmetric Encryption

A
  • Advanced Encryption Standard (AES), Microsoft tools
  • Triple DES or 3DES, payment cards
  • Blowfish, Bruce Schneier developed Blowfish as a possible alternative to DES, bcrypt
37
Q

What is the primary risk of sending unencrypted data over a network?

A

A sniffing attack - Attackers can use a sniffer or protocol analyzer to capture traffic sent over a network. The sniffer allows attackers to read all the data sent in cleartext

38
Q

How to protect data in transit?

A
  • HTTPS, encrypts e-commerce transactions
    • HTTPS uses TLS (Transport Layer Security)
  • VPNs use TLS and IPsec for encryption
  • TLS
  • IPsec, Internet Protocol Security
  • Secure Shell (SSH), administrators use SSH when administering remote servers
39
Q

Protocols that transmit data in cleartext?

A
  • HTTP
  • FTP
  • Telnet
  • L2TP, Layer 2 Tunneling Protocol transmits data in cleartext
40
Q

Data owner

A

Person who has ultimate organizational responsibility for data.
Data owner is typically the CEO, president or a department head.
Data owners identify the classification of data and ensure that it is labeled properly.

41
Q

Asset owner

A

The asset owner (or system owner) is the person who owns the asset or system that processes sensitive data.
Same person as the data owner but can be different like the Department Head.

42
Q

System owner

A

Ensuring that the data processed on the system remains secure.
System is labeled accurately and that the appropriate security controls are in in place to protect the data.

43
Q

Business owner

A

Owns the processes that use systems managed by other entities.
Ensure that systems provide value to the organization

44
Q

What is COBIT?

A

Control Objectives for Information and Related Technology (COBIT) - IT governance method that helps business owners and mission owners balance security control requirements with business or mission needs.

45
Q

Data processor

A 
Any system used to process data.
European Union (EU) General Data Protection Regulation (GDPR) defines a data processor as “a natural or legal person, public authority, agency, or other body, which processes personal data solely on behalf of the data controller"
46
Q

GDPR

A

European Union (EU) General Data Protection Regulation (GDPR)

  • Regulation in EU law on data protection and privacy in the European Union (EU).
  • It addresses the transfer of personal data outside the EU.
  • The GDPR restricts data transfers to countries outside the EU
47
Q

Data controller

A

The person or entity that controls processing of the data

Example: a third-party company to process payroll, the payroll company is the data processor.

48
Q

Administrator

A

Responsible for granting appropriate access to personnel.
Assign permissions based on the principles of least privilege and the need to know, granting users access to only what they need for their job

49
Q

Custodian

A

Data owners often delegate day-to-day tasks to a custodian. A custodian helps protect the integrity and security of data by ensuring that it is properly stored and protected. For example, custodians would ensure that the data is backed up in accordance with a backup policy.

50
Q

Security baseline

A

Baselines provide a starting point and ensure a minimum security standard.
One common baseline that organizations use is imaging.

51
Q

Scoping and Tailoring

A
  • Scoping refers to reviewing a list of baseline security controls and selecting only those controls that apply to the IT system you’re trying to protect.
  • Tailoring refers to modifying the list of security controls within a baseline so that they align with the mission of the organization

CISSP Domains 1-8 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions