Unit 5 - Module 1 - Assets Flashcards
What do you call anything that can impact the confidentiality, integrity, or availability of an asset?
Risk
What are the 3 main things to think about when security risk planning ?
Assets
Threats
Vulnerabilities
What do you call an item perceieved as having value to an organization?
Asset
What do you call any circumstance or event that can negatively impact assets?
Threat
What do you call a weakness that can exploited by a threat?
Vulnerability
What is the process of tracking assets and the risks that affect them?
Asset Managment
What do you call a catalog of assets that need to be protected?
Asset Inventory
What do you call the practice of labeling assets based on senesitivity and importance to an oranganization?
Asset Classification
What are the 4 orders of asset classification?
1) Public - is the lowest level of classification. These assets have no negative consequences to the organization if they’re released.
2) Internal-Only -describes assets that are available to employees and business partners.
3) Confidential - refers to assets whose disclosure may lead to a significant negative impact on an organization.
4) Restricted - is the highest level. This category is reserved for incredibly sensitive assets, like need-to-know information.
What do you call information that is translated, processed, or stored by a computer?
Data
What do you call data being accessed by one or more users?
Data in use
What do you call data traveling from one point to another?
Data in transit
What do you call data not currently being accessed?
Data at rest
What do you call the practice of keeping data in all states away from unauthorized users?
Information security ( InfoSec )
What are 4 cloud security challenges?
Misconfiguration - Customers of cloud-based services are responsible for configuring their own security environment. Oftentimes, they use out-of-the-box configurations that fail to address their specific security objectives.
Cloud-native breaches - are more likely to occur due to misconfigured services.
Monitoring access might be difficult - depending on the client and level of service.
Meeting regulatory standards - is also a concern, particularly in industries that are required by law to follow specific requirements such as HIPAA, PCI DSS, and GDPR.
