Domain 2 - Asset Security Flashcards
1
Q
what are the stages to data lifecycle
A
- create/update
- store/classification
- use
- share
- archive
- destroy - data cant stay around longer than necessary. it creates risk and liability. It can be stolen, it can be called as evidence for legal actions
2
Q
What are some data security controls
A
- marketing, labeling, handling, classifications - classifications is the most important
- data handling - shipping, chain of custody. dont open boxes
- data destruction - erasing, clearing (overwriting w/ unclassified data)
record retention - if the retention policy is 1 year, it should be destroyed when it ages out @ 1 year - tape backup security - secure offsite facility, tapes labeled, ensure all understand the classification of the data
3
Q
what is a security control baseling
A
- provides a listing of controls that an organization can apply as a baseline
- a group of controls that can be applied as a base standard or starting point that we work from
4
Q
when it comes to data protection, what can you use to guarantee confidentiality
A
encryption
5
Q
should asset classification match data classification
A
yes
6
Q
what is (PII) personally identifiable information
A
- any information that can identify and individual
- (name (non common), SSN, birthdate/place, biometric records, education, medical history, financial transactions, mothers maiden name, criminal or employment history, etc.)
7
Q
what is (PHI) protected health information
A
health related information that can be related to a specific person (covered by HIPAA)
8
Q
define Data owner/controller
A
- usually a member of senior management or the board
- accountable for the protection of data
- define level of classification - responsible for security decisions for DATA
- holds legal rights and defines policies
- can delegate some duties
- can not delegate responsibility
9
Q
define data custodian
A
- usually a member of IT
- does not decide what controls are needed
- implements controls from the data owner
- grants permissions, monitors, data archive, backup and restore checks, etc.
**** on behalf of the data owner
10
Q
define data administrator
A
- responsible for granting appropriate access to personnel (often via RBAC) - roll based access control
11
Q
define user
A
any person who accesses data via a computing system to accomplish work tasks
12
Q
define business/mission owner
A
- senior executives make the policies that govern our data security
- can overlap or or be the same as the system owner
13
Q
define system owner
A
- management level and owner of the systems that house the data
- often a data center manager or infrastructure manager
14
Q
define security administrators
A
- responsible for firewalls, IPS, IDS, security patches, creates accounts
- grants access to data following the data owners direction
15
Q
define supervisor
A
- responsible for user behavior and assets created by the users
- responsible for user awareness
- needs to inform the security administrator if there are any changes to user employment status, user access rights or any other pertinent changes to employees status
16
Q
define asset owner
A
- owns assets or systems that process sensitive data and associated security plans
17
Q
should each asset have an owner
A
yes, the owner is accountable for the protection of an asset
18
Q
what do baselines define
A
minimum security requirements for each class
19
Q
define classification
A
a system of classes ordered according to value
example: public, proprietary, confidential is one possibility of the the three classification an organization might use to define classes, with public being the least valuable and confidential being the most valuable
20
Q
what is labeling of an asset
A
- noting the classification of an asset on an asset.
- the what, what the classification is
example: putting a label on a backup tape noting that its top secret
21
Q
what is marking of an asset
A
- the how the asset should be protected based on its classification
- involves noting the handling instructions on the asset based on the classification
22
Q
what is categorization
A
- the act of sorting assets into the defined classes
- its a process of putting assets into different classes
23
Q
define data processor
A
- responsible for processing data on behalf of the owner
typical example: cloud service provider. they are storing and processing data on behalf of the owner
24
Q
define data subject
A
- the individual to whom any personal data relates, its data about them
25
ways to protect data at rest
1. encryption
2. strong access controls - to make sure authenticated and authorized persons have access to data
3. backups - to verify data is not lost or destroyed
26
end to end encryption attributes
1. a protection for data in motion
2. its encrypted right from the send and the data remains encrypted through all notes (switches, routers, firewalls etc.) that is passes on its way to the recipient
3. only encrypted once it has reached the recipient, its never in plaintext in transit
4 perfect example: VPN
5. the downside the routing information (source and destination IP address) must be in plaintext
6. this does not provide anonymity
27
link encryption attributes
1 encrypted and decrypted at every node
2. packet including the header is encrypted at the source and sent to the first destination
3. first source decrypts the packet, looks for the destination address, re-encrypts the packet and forwards to the next node
4. advantage - routing information is hidden in transit
5. downside - its decrypted at every node, not the best for protecting data
28
onion networks attributes
1. provide confidentially and anonymity
2. the sender device will predetermine a series of notes that the packet is going to pass through to the destination
3. sender device will encrypt the entire packet for every node it will pass through
4. each layer of encryption will use the specific encryption key for the next node, one layer (node) at a time
5. last layer to be decrypted with only be at the destination and only then will the data be decrypted
6. each node on the way only knows where the packet came from and the next node but not the ultimate source and destination
7. each layer has zero access to the innermost layer
8. downside is performance
example of an onion network: TOR the onion router
29
how to protect data in use
1. good access controls
2. potentially data loss prevention controls to monitor and control what users are doing with the data
3. data in use cannot be encrypted
30
what is data archiving
1. moving data that is no longer being used, to a cheaper storage solution for long term retention
2. archived data is only kept as long as its useful or required by law
3. protection of that data is in accordance to its classification
31
data destruction from best to worst
1. burn it
2. shred/disintegrate or drill a hole in the media --- with the right tools partial data can still be recovered
3. degaussing - applying a very strong magnetic field to magnetic media like hard drives or tape (not SSD) -- sits between destruction and purging (it might permanently render media unusable)
4. crypto shredding -- encrypt the data with an excellent algorithm like AES 256 then we destroy every copy of the key (sits between purging and clearing)
5. overwriting, wiping, erasure, all refer to writing all zeros or ones or some combination to all the sectors of a storage device (research has shown that no matter how many times you overwrite the data, some of the data may be recoverable) thus this is clearing
6. the worst method of destroying data is formatting the drive. formatting by default leaves most if not all the existing data
32
3 types of defensible destruction in order from best down
1. destruction
2. purging
3. clearing
33
define privacy
the state or condition of being free from being observed or disturbed by other people
34
what role do may regulations require the company to have
data controller - an owner for the privacy program that is accountable for the privacy controls within the organization
35
what is the main thing we are protecting from a privacy perspective
personal data - information that can be used on it own or in combination to identify an individual
36
what are 4 ways different laws can refer to personal information
1. PII - personally identifiable information
2. SPI - sensitive personal information
3. PHI - personal health information
4. PI - personal information
37
what are direct identifiers and some examples
something that can identify and individual on it own.
examples: government IDs, social insurance numbers, social security number, drivers license numbers, passport numbers, back account numbers, phone numbers biometric data etc.
38
what are indirect identifiers and examples
identifiers that on their own are not able to identify an individual but if you have enough indirect identifiers you can uniquely identify an individual
examples: age, gender, ethnicity, the state someone lives in, zip code or postal code etc.
39
what are online identifiers and examples
individual identifiers that are online
examples: email address, IP addresses, cookies
40
name this data lifecycle;
new data is generated or existing data is altered, updated or modified in some way
data creation/update
41
what happens in the store stage of the data lifecycle
data is committed to some sort of storage repository to memory or a hard drive
42
what is the 3rd stage and explanation of the 3 stage in the data lifecycle
1. use stage
2. this is where people or processes are "using" the data. this covers viewing, processing or in someway using the data but absolutely not modifying
43
explain the sharing stage of the data lifecycle
this is where we think about who the data can be shared with under what circumstances and with what controls in place
44
what happens in the archive state of the day lifecycle
1. this is where data is moved to cheaper long term storage (usually tapes) maybe some form of cloud
2. that data should be retained for as long necessary based on the retention policy
45
what is the last stage of the data lifecycle and explain
1. destroy stage
2. when data is no longer needed by the organization, this data should be physically or logically destroyed
3. depending on requirements, data my need to be defensively destroyed
46
what is the most important thing to do at the very start of the data lifecycle
1. classify the data
2. this shows how valuable the data is to the organization and drives the controls in each stage of the data lifecycle
47
what are the government classifications from 3-0 and damage
* top secret (3)- exceptionally grave damage
* secret (2)- serious damage
* confidential (1)- damage
* unclassified (0)- no damage
48
what are the public classifications and from 3-0 and damage with each
* confidential/proprietary (3)- exceptionally grave damage
* private (2)- serious damage
* sensitive (1) - damage
* public (0)- no damage
49
data destruction - erasing is what
performing a delete operation against a file, files, or
media.
50
data destruction - clearing (overwriting) is what
* preparing media for reuse
* when media is cleared, unclassified data is written over all addressable locations on the media.
* data cannot be recovered using traditional recovery tools.
* not sure on this statement. once completed the media can be reused at the same security level?
51
data destruction - purging is what
a more intense form of clearing that prepares
media for reuse in less secure environments.
52
data destruction - degaussing is what
creates a strong magnetic field that erases
data on some media.
53
data destruction - destruction is what
the final stage in the lifecycle of media and is
the most secure method of sanitizing media.
54
what is the correlation between asset classification and data classification
Asset classifications should match the data classifications.
55
data steward
* same as data custodian
* Business responsibility for data (e.g. metadata definition, data quality, governance, compliance, etc.) on behalf of data owner
56
define mission/business owner
senior executives, make policies that govern data
57
define data processor
* any entity that does processing of PII on behalf of the data owner [typically, a third party, external to the data owner]
* typically an entity that works under the direction of the owner/controller, such as an IT department.
58
define system owner
management level and owner of systems that house the data.
example: data center manager or infrastructure manager.
59
define supervisor
responsible for users behavior and assets created by users. directly responsible for user awareness, informs security admins of changes to employee status, user rights or other employee status changes
60
define users
* User of data.
* They must be trained on user awareness. They do not know acceptable uses and consequences for breaking policies, procedures and standards
61
define auditors
* responsible for reviewing and confirming security policies are implemented correctly, that we adhere to them and they provide the correct protection.
62
Which Set Of Organizational Policies And Procedures Would Best Describe The Process For Moving Modified Source Code Into Production?
A. Change Management
B. Asset Management
C. Acceptable Use
D. Data Governance
Correct Answer: A
Change management policies describe the process for requesting, reviewing, implementing, and deploying changes in a production environment. This includes the release of new source code to production use. Asset management policies are used to track hardware, software, and other assets belonging to the organization. Acceptable use policies place restrictions on how users may interact with technology systems. Data governance policies set forth requirements for data ownership, stewardship, and care.
63
what does data governance do
- -improves data quality to be compliant with regulations/policies.
- -Senior management is aware, accountable and committed.
- -Data governance starts with strategy
64
define data subject
the person who the information is about
65
define data controller
same as data owner when a true data owner does not exist
66
what are the military data classification Levels
* top secret -- disclosure could cause severe damage
* secret -- disclosure could cause serious damage
* confidential -- exempt from disclosure under law
* sensitive but unclassified -- disclosure could do some harm
* unclassified -- no classification or sensitivity
67
with MAC access do objects or subjects have labels applied to them
• both
68
how are labels used with access
• labels allow subjects with the right clearance to access them
69
labels are more often more granular than top secret. how might that look
* top secret then a nuclear sub category and maybe a submarine category within that
* you would need the right access to get down to the submarine sub category
70
opposite of CIA is what acronym and what is each side
* DAD
* disclosure
* Alteration
* Destruction
71
what are the 3 states of data
* at rest
* in motion
* in use
72
securities for data at rest
* data at rest is stored ( disk, tapes, cd's, dvd's, usb sticks)
* backups
* encryption (disk or device)
73
securities for data in motion
• encrypt the network end to end (tls, ssh, IPsec) internal and external networks
74
securities for data in use
* preventing shoulder surfing ( monitor view angle covers)
* clean desk policy
* print policy (no leaving documents on printer, using key fob or key codes to print documents when you get to the printer)
* locking computers
75
how long do you keep data
• follow the letter of your organizations retention policy (no longer, no less)
76
what entity's should you be looking at for data storage retention policies
* . your organizations policy
* regulations (PCI DSS, HIPAA)
* industry specific retention policies
77
what is mission/business owner
• senior executive who make the policy that govern our security
78
define data/information owner
* management level, they assign sensitivity label's and backup frequency
* this could be you or a data owner from HR, payroll, or other department
79
define system owner
* management level and the owner of systems that house the data
* often a data center manager or infrastructure manager
80
define security administrator
• responsible for firewalls, IPS, IDS, security patches, create accounts, grant access to data according to data owner requirements.
81
define supervisor
* responsible for user behavior
* responsible for user awareness
* informs security administrator of any security changes (access rights, employee changes etc.)
82
define users
* users of data
* user awareness must be trained
* need to be taught was is acceptable and what is not
83
define auditors
• responsible for reviewing and confirming security policies are implemented correctly, we adhere to them and they provide the protection required.
84
is data deletion secure
• no -- data is still completely recoverable
85
is formatting considered secure
* no -- not much different than data deletion other than it puts a new file structure over the old one
* its still completely recoverable
* reformatting and reimaging is the same level of weakness with data destruction
86
name the 3 main categories of data removal
* clearing
* purging (no recovery)
* destroying
87
what type of date removal fit into the category of clearing
* wiping
* overwriting
88
is data clearing recoverable
• yes, with the correct tools
89
what falls into the category of purging
• sanitizing the data (not the media)
90
is purging data recoverable
• no
91
what fit into the category of data destroying
* shredding
* burning
* pulverizing
* corrosive chemicals
92
best methods for destroying data on SSD's
* crypto erase
* purging
* overwriting
* best method is physical destruction
93
what is scoping
• removing baseline security controls that do apply.
example: removing privacy controls where private data does not exist.
94
what is tailoring
• modifying the baseline to become more applicable.
example: changing timeout requirements from 10 minutes to 5 minutes
choosing to use a stronger AES 256 encryptions over triple des
95
what is certification
* is the technical evaluation of the security compoent6ns within a produce (in my environment)
* a formal process normally done by and outside auditor
96
what is accreditation
* the formal acceptance of the products overall security by senior management
* risk is acceptable
* certified products is approved to operate (be useable) after accreditation
97
what does DRM stand for
• digital rights management
98
what can be DRM
* watermarks
* encryption on DVD's
* copy restrictions (copy, edit, saving, screenshots, screen recording, printing)
99
what does CASB stand for
• cloud access security broker
100
what is a CASB
* on premise or cloud software between users and cloud applications
* monitors user activity
* warns admins about possible malicious/dangerous, actions.
* malware prevention, protects against shadow IT and enforces security policy compliance
101
2 types of DLP
* data loss protection
* data leak protection
102
what is exposure
* the presence of a vulernability when a related threat exists
* being susceptable to asset loss because of a threat; there is the possibiltiy that a vulnerability can or will be exploited
103
do firewalls and intrusion detection systems ensure confidentiality, integrity and availability
perfect world yes! by always preventing unauthorized users access
104
according to RFC 1087 Ethics and the Internet. what are 4 things that are unacceptable
a) seeks to gain unauthorized access to the resources of the internet
b) disrupts the intended use of the Internet
c) wastes resources (people, capacity, computer) through such actions,
d) destroys the integrity of computer-based information, and/or (e) compromises the privacy of users.
105
common criteria (ISO 15408) levels
* EAL1: Functionally Tested. ...
* EAL2: Structurally Tested. ...
* EAL3: Methodically Tested and Checked. ...
* EAL4: Methodically Designed, Tested, and Reviewed. ...
* EAL5: Semi-Formally Designed and Tested. ...
* EAL6: Semi-Formally Verified Design and Tested. ...
* EAL7: Formally Verified Design and Tested.
106
KPI - what does it do
1. Key Performance Indicator (KPI) is used to measure the effectiveness of the security controls associated with the risks.
**_Example:_** we develop an employee awareness program with sending simulated phishing emails to the employees, in order to train them on how to respond to phishing emails and measure their responsiveness. Assume the initial results shows 20% of the employees click on phishing emails, and our goal (our KPI) is to reduce that number to be 2%. If we see the number of employees clicking on phishing emails reduces during time, and getting close to that number, that indicates our control is working effectively.
107
examples of PKIs
* Create or know your baselines. abnormalities above and below your water mark is what you are looking for \
* constantly need to be checking your PKIs vs your goals
1. Level of Preparedness
1. How many devices on your corporate network are fully patched and up to date?
2. Unidentified Devices on Internal Networks
1. Employees can introduce [malware](https://www.upguard.com/blog/malware) and other cyber risks when they bring in their own devices,
3. Intrusion Attempts
1. create a baseline and what for abnormalities
1. too low could be something wrong with the detection or blocking controls
2. too many, there could be an active attack
4. Security Incidents
1. How many times has an attacker breached your information assets or networks?
5. Mean Time to Detect (MTTD)
1. ****How long do security threats go unnoticed? how long did it take to become aware of the indicators of compromise
6. Mean Time to Resolve (MTTR)
1. What is the mean response time for your team to respond to a [cyber attack](https://www.upguard.com/blog/cyber-attack) once they are aware of it?
108
prudent man rule
* Invoked by the Federal Sentencing Guidelines, the rule that requires senior officials to perform their duties with the care that ordinary, prudent people would exercise under similar circumstances.
109
4. data sanitization
110
what is considered data sanitization
1. degaussing
2. crypto shredding
3. destruction
4. shred
1. destruction
2. shred
degaussing is on the line between sanitization (it can sometimes kill the drive) and purging
111
what is considered purging
1. wipe
2. format
3. degauss
4. encryption
degauss (remember both destruction and purging)
112
which are considered clearing data (data deletion
1. overwrite/wipe/erasure
2. format
3. purging
4. crypto shredding
1. overwrite/wipe/erasure
2. format
* crypto shredding is on the line between purging and clearing
* crypto shredding will render the data unusable if encrypted with a good algorithm and all the keys have been destroyed. but if the data is still there
* if there was a weakness discovered in that algorithm or quantum computing became a thing, that data would be recoverable
