2. Asset Security

2. Asset Security

1. 2.1 Classifying Assets

   • Asset Classifications
   • US. Government and military classifications
   • Private Sector classification Schemes
   • Asset classification Policy
   • CISSP Exam Tips
     • Federal agencies are required to classify information and information systems using FIPS 199
     • There is no mandated classificaton system for the private sector
     • Information assets are generally classified by content sensitivity

2. 2.2 Managing Assets

   • Responsibilities
   • Asset Management
   • Asset Lifecycle
   • Inventory Management
   • Congiguration Management
   • CISSP Exam Tips
     • Inventory is a key component of vulnerability management
     • Configuration Management maintains system integrity
     • There are security considerations at every stage in an asset's lifecycle

3. 2.3 Protecting Data Privacy

   • PII Protections
   • Privacy frameworks and the OECD Privacy Principles
   • Privacy policies and statements
   • CISSP Exam Tips
     • Never collect more data than necessary
     • EU Privacy laws are stricter than US laws
     • Definition of PII varies by law, regulation, country and custom

4. 2.4 Ensuring Appropriate Retention and Destruction

   • Data Retention
   • Data archiving
   • eDiscovery and Federal Rules of Civil Procedure
   • Data Deletion
   • Data Remanence
   • Data destruction including disk wiping and degaussing
   • CISSP Exam Tips
     • Consult with legal counsel or compliance experts on retention requirements
     • Per FRCP , digital data is discoverable
     • Disk wiping and disk degaussing are for permanent destruction techniques

5. 2.5 Determining Data Security Controls

   • Controls selection
   • Encryption
   • Handling standards
   • CISSP Exam Tips
     • Encryption is a universally recommended control
     • Be familiar with NIST Special Publication 800 Series
     • Data states are at Rest, in Use, and in Transit