Domain 2: Asset Security Flashcards Preview

CISSP > Domain 2: Asset Security > Flashcards

Flashcards in Domain 2: Asset Security Deck (28):
1

Sensitive Data

any info that isn't public or unclassified

2

PII

Personal Identifiable Information - any info that can be used to distinguish or trace an individuals identity

3

PHI

Protected Health Information - any health info that can be related to a specific person

4

Proprietary Data

any data that helps an org maintain a competitive edge

5

DLP Server

Data Loss Prevention Server, emails pass through, detects labels on data or applies necessary security measurs

6

Data at Rest

data stored on media

7

Data in Transit

data in motion, data transmitted over a network

8

Data in use

data in temporary storage buffers while an application is using it

9

Handling

secure transportation of media through its lifetime

10

Data Remanence

The data that remains on a hard drive as a residual magnetic flux

11

How to remove data remanence

degausser for magnetic media, not SSDs. Use destruction to a size of 2 mm

12

Erasing

deleting files, remains on the drive until space runs out

13

Clearing

prepare media for reuse and assure the cleared data cannot be recovered

14

Purging

more intense form of clearing, repeat clearing or combine with another process

15

Declassification

any process that purges media or a system in preparation for reuse in an unclass environment

16

Sanitization

combination of processes that removes data from a system of from media ensuring it cannot be recovered by any means

17

Degaussing

create a strong magnetic field that erases data on magnetic media

18

Which protocol do most HTTPS transmissions use?

TLS - Transport Layer Security

19

What was the predecessor to TLS?

SSL - Secure Sockets Layer but it is susceptible to the POODLE attack

20

What does a VPN use?

IPsec combined with L2TP

21

Which protocols would be used to protect data in transit on internal networks?

IPsec and SSH (Secure Shell)

22

What are secure protocols used to transfer encrypted files over a network?

SCP (Secure Copy) and SFTP (Secure File Transfer Protocol)

23

This person has the ultimate org responsibility for the data

data owner - typically CEO

24

This person owns the system that processes sensitive data

System Owner

25

This person is usually the PM

Business/Mission Owner

26

Data processor

a natural or legal person which processes personal data solely on behalf of the data controller

27

This person is responsible for granting appropriate access to personnel

Admins

28

This person handles day to day tasks usually assigned by data owner

custodian