Domain 2 - Asset Security Flashcards
What are the commercial data classifications? (From Grave Damage to No damage)
- Proprietary/Confidential
- Private
- Sensitive
- Public
What are the US Government Data Classification?
- TOP SECRET
- SECRET
- COMMERCIAL
- Unclassified
What principle of security does compartmentalisation apply?
Need-to-know
What activities are used to assist an organisation in forming a minimum security baseline?
Scoping and tailoring
What is scoping?
Process of determining which portions of a standard will be used by the organisation. Example is the Statement of Applicability (SoA)
What is tailoring?
Tailoring is the process of customising a standard for a organiation:
1. control selection for initial security baseline
2. scoping for the remaining baseline security controls
3. Application of compensating controls
What is pseudonymisation?
De-identification process to remove PII.
This can be reversed as it is like an alias.
What is anonymisation?
Process to either encrypt or remove PII. This is irreversible. However data inference can still be used to counter anonymisation.
What is tokenisation?
A value that is substituted to replace a sensitive data item. e.g. payment card data.
What should asset classification be based on?
This should be based on the data classification. If it processes SECRET data then the computer should be classified the same.
What should PHI, PII, financial data, employee data, payroll data be classified as?
Private
What is the role of the system owner?
- Creation of SSP
- Ensures users receive adequate training
- Assists with identification, implementation and assessment of common security controls
What is the role of business/mission owners?
- Senior executives that make the policies that govern the data security.
What is the role of data controllers?
Controllers create and manage sensitive data in the organisation (e.g. HR/Payroll)
What is the role of data processors?
Processors manage the data for controllers (e.g. outsourced payrolll)
