Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

- > Domain 2: Asset Security > Flashcards

Domain 2: Asset Security Flashcards

1
Q

Information lifecycle

A

Acquisition, Use, Archival and Disposal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define the Acquisition information lifecycle stage?

A

This includes creation or copying of data and applying policy controls, such as encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define the Use information lifecycle stage?

A

Where data is read or modified by users. Need to ensure confidentiality, integrity and availability are applied here.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define the Archival information lifecycle stage?

A

Process of archiving or backing-up data for business or regulatory purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define the Disposal information lifecycle stage?

A

Process of destruction of data that is no longer needed. Data must be rendered sufficiently difficult for an adversary to recover so that the risk of such recovery is acceptable to our organisation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define Data Classification

A

Development of sensitivity labels based on value of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define PII

A

Personally Identifiable Information. This is any information about an individual. This can include name, social security number, DOB, biometric records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define PHI

A

Protected Health Information. This is any health related information that can be related to a specific person. The Health Insurance Portability and Accountability Act (HIPAA) mandates the protection of PHI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Types of data that classification levels apply to?

A

ALL data, regardless of format, including digital, paper, video, fax, audio etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define common levels of classifications for Government/Military use

A

Top Secret, Secret, Confidential, Sensitive but unclassified, and Unclassified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define common levels of classifications for private/commercial use

A

Confidential, Private, Sensitive, Public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define information classification

A

Process of understanding the value and assigning classification labels for both physical assets, and digital assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Define asset classification

A

Ensure that physical assets are also adequately protected, through use of sensitivity classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data protection key considerations

A

Who has access to the data, what controls are in place, and what devices can be used to access data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Three states of data

A

Data at Rest, Data in Transit, Data in Use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define Data at Rest

A

Involves data stored on media such as system hard drives, external USB drives, and backup tapes. Use of encryption is popular here.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Define Data in Transit

A

Involves data transmitted over a network. Use of TLS is applied here

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define Data in Use

A

Refers to data in memory or temporary storage buffers, while an application is using it. Application buffers are typically cleared after use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define data breach

A

Any event in which an unauthorised entity can view or access sensitive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define data leak

A

Where the confidentiality of data has been compromised

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Role of Executives

A

Hold ultimate responsibility for everything that happens in their organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CSO vs CISO

A

CSO focused on broader security risks (including, physical security), while CISO is typically much more technology focused

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Define role of Data Owners

A

Responsible for ensuring the necessary security controls are in place, defining the security classifications and requirements. Owners can be held liable for negligence if they fail to perform due diligence in establishing and enforcing security policies to protect and sustain sensitive data.

24
Q

Rules of Behaviour

A

Clearly delineate responsibilities and expected behavior of all individuals with access to the system.

25
Data custodians
Help protect data on a day-to-day basis. This includes, implementing and maintaining security controls, performing regular backups, validating integrity of data, restoring from backup media, retaining audit logs.
26
Asset/System Owner
Person who owns the asset. Ensures system is labelled accurately and that appropriate security controls are in place.
27
Business/Mission Owners
Responsible for ensuring systems provide value to business
28
Data processors
Any system/person that processes personal data on behalf of data controller
29
Data controllers
Person or entity that controls processing of data
30
Data Administrator
Responsible for granting appropriate access to personnel
31
Users
Any person who has access to data to accomplish work tasks
32
Security Administrator
Responsible for implementing and maintaining specific security network devices and software in the enterprise
33
Supervisor
Responsible for all user activity and any assets created and owned by these users
34
Change control analyst
Responsible for approving or rejecting requests to make changes to the network, systems, or software
35
Data analyst
Ensures company data is stored properly and follows a standardised naming scheme
36
Auditor
Auditors check that the organisation complies with its own policies, and applicable laws and regulations.
37
Four principles of retention
Taxonomy: scheme for classifying data, such as HR-1 Classification: use of sensitivity labels Normalisation: retained data can come in a variety of formats, but can be read universally Indexing: data can be accessed quickly
38
E-Discovery
Process of collecting and processing electronic material for use in litigation. 1. Identification 2. Preservation 3. Collection 4. Processing 5. Review 6. Analysis 7. Production 8. Presentation
39
Pseudonymisation
Use of alias, to represent other data. Such as use of patient number, instead of name.
40
Anonymisation
Process of removing all relevant data so that it is impossible to identify the original
41
Data Masking
Masks data in individual columns, so it cannot be identified
42
Erasing
Simply deleting a file from the device
43
Clearing (overwriting)
Overwriting a file with other junk
44
Purging
More intensive version of clearing. This overwrites data multiple times, however, is not suitable for top secret data.
45
Degaussing
Use of magnetic fields to destroy HDD's and magnetic tapes
46
Scoping
Process of taking a broader standard and trimming out the irrelevant or otherwise unwanted parts
47
Tailoring
Customising specific provisions so they better address your requirements.
48
Define DLP
Data Loss Prevention, focused on preventing unauthorised external parties from gaining access to sensitive data. NOT for internal parties.
49
Four Step DLP Process
1. Data Inventory: identify the most important data 2. Data Flows: ensure that DLP tools are used strategically through specific network pathways. 3. Data Protection Strategy: Through a risk assessment 4. Implementation, Testing, and Tuning: Focus on ensuring the accuracy, interoperability, and policy engine are adequate for organisation's needs.
50
Types of DLP
1. Network DLP: Usually implemented at network perimeter, for the protection of data in motion. 2. Endpoint DLP: Applies protection policies to data at rest and in use on endpoint devices. 3. Hybrid DLP: Combination of both NDLD and EDLP
51
EU-US Privacy Shield
It is a framework for regulating exchange of information between EU and USA. One of its purposes is to enable US companies to more easily receive personal data from EU entities under EU privacy laws, meant to protect European Union Citizens.
52
7 Principles of EU-US Privacy Shield
1. Notice: an organisation must inform individuals about the purposes for which it collects and uses information about them 2. Choice: an organisation must offer individuals the opportunity to opt out 3. Accountability for onward transfer: organisations can only transfer data to other orgnaisations that comply with Notice and Choice principles. 4. Security: must take reasonable precautions to protect personal data. 5. Data integrity and purpose limitation: organisations should only collect data that is needed for processing purposes identified in the Notice principle. 6. Access: individuals must have access to personal information on organisation holds about them. 7. Recorse, enforcement, and liability: organisations must implement mechanisms to ensure compliance with the principles and provide mechanisms to handle individual complaints.
53
System hardening
Removing unncessary services, and changing default settings
54
Obfuscation
Process of hiding, replacing or omitting sensitive information
55
Tokenisation
Process of using tokens to represent other data, this is is similar to pseudonymization.

- (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions