Chapter 5.8

Question 1

PHI

Answer 1

Protected Health Information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results. PHI is associated with a specific person or used as an anonymized or de-identified data.

Question 2

PII

Answer 2

Personally Identifiable Information (PII) is data that can be used to identify, contact, or locate an individual. A Social Security Number (SSN) is a good example of PII.

Question 3

Confidential

Answer 3

Confidential (or low) information is highly sensitive, and intended for viewing only by approved persons within the organization (and possibly by trusted third-parties under NDA). Confidential is a category defined by a military classification scheme.

Question 4

Proprietary

Answer 4

Proprietary information or intellectual property (IP) is information created by a company, typically about the products or services that they make or perform.

Question 5

Archives

Answer 5

Archives refer to sets of data. Since data retention is high-priority, an archive plan should be established and/or reviewed to ensure data sets are held for the appropriate length of time.

Question 6

System Images

Answer 6

System images are copies of entire computer systems. These images are helpful during investigations as backup copies. A system image is a backup technique and does not address retention needs.

Question 7

Secret

Answer 7

Secret (or medium) information is too valuable to permit any risk of capture. Viewing is severely restricted to authorized individuals only.

Question 8

Classified

Answer 8

Classification restricts who may see a document’s contents. Classified (private, restricted, internal use only, official use only) material restricts viewing to the owner organization or third-parties under a Non-Disclosure Agreement (NDA).

Question 9

Unclassified

Answer 9

Unclassified (public) information is available to anyone, and holds no viewing restrictions.

Question 10

Data owner

Answer 10

A data owner has the ultimate responsibility for maintaining the confidentiality, integrity, and availability of the information asset. The owner is also responsible for labeling the asset (such as determining who should have access and determining the asset’s criticality and sensitivity).

Question 11

Data steward

Answer 11

A data steward role is primarily responsible for data quality. This involves tasks such as ensuring data is labeled and identified with appropriate metadata, and that data is collected and stored in a format that complies with regulations.

Question 12

Data custodian

Answer 12

A data custodian is responsible for managing the system where the data assets are stored. This includes responsibility for enforcing access control, encryption, along with backup and recovery measures.

Question 13

System administrator

Answer 13

A system administrator is responsible for ensuring the upkeep of the technical systems that provide functionality for the business.

Question 14

Wiping

Answer 14

Wiping the media involves erasing. There are many methods and utilities available to perform such actions, like low level format. This method may be time consuming, but it is cost effective and requires very little interaction.

Question 15

Burning

Answer 15

Burning media involves using fire to destroy contents. Burning releases toxins that can be dangerous and should only be performed in a controlled environment

Question 16

Degaussing

Answer 16

Degaussing involves exposing magentic media, such as hard disks or tapes, to a powerful electromagnet which disrupts the magnetic pattern that stores the data on the disk surface. This effectively “erases” the media.

Question 17

Pulping

Answer 17

Pulping involves mixing the media, such as shredded media, with water, then pulverizing to further destroy the contents.

Question 18

PCI

Answer 18

Payment Card Industry (PCI) relates to information and related security standards for organizations that process credit or bank card payments.

Question 19

Purging

Answer 19

Purging is the process of repurposing storage media. In this case, old hard drives are being wiped to erase data in order to be used in other systems.