Chapter 5 - CISSP Domain 2 - Protecting Security of Assets

Chapter 5 - CISSP Domain 2 - Protecting Security of Assets

1. Classifying and Labeling Assets

   • Defining Sensitive Data
     • Proprietary Data
       • Intelectual Property
       • Trade secrets
       • Blueprints
     • Privacy related
       • PII
       • PHI
   • Defining Classifications
     • Classifications Levels
     • Applies to Data and Hardware
     • Damage done when disclosed
   • Defining Data Security Requirements
     • Higher classification needs higher security
   • Understanding Data States
     • Data states; motion, use, rest.
   • Managing Sensitive Data
     • To prevent unwanted disclosure
     • Marking / labelling to easy identify the classification
       • To provide linking pin for DLP
     • Secure transport based on classification
     • Secure storage based on classification
     • Proper destruction when data becomes no longer needed
       • Getting rid of data remanence
       • Data destroyment
         • Purging
         • Declassification
         • Sanitisation
         • Degaussing
         • Destruction
           • SSD cant be erased, they need total destruction
     • Retaining and maintaining by record retention
   • Protecting Confidentiality with Cryptography
     • Protecting data with symmetric encryption
       • AES
     • Protecting data with transport encryption
       • VPN, HTTPS

2. Identifying Data Roles

   • Data Owners
     • Ultimately the CEO is liable for negligence
     • Check label and classification
   • System Owners
     • Develops and maintains Security Plan
     • Ensures delivery of security training
   • Business / Mission Owners
     • Owners of business processes
     • Ensures systems to provide business value
   • Data Processors
     • Any system used to process data
       • EU Data Protect: natural or legal person
     • EU Data Protect: restricts data tranfers outside EU
       • US: Safe Harbor Program
       • 7 principles; Notice, Choice, Onward Transfer, Security, Data integrity, Access, Enforcement
   • Admins
     • Granting access / assigning permissions
       • RBAC
   • Custodians
     • Helps protect security and integrity
       • Typically IT dept.
   • Users
     • Anyone using / accessing the data

3. Protecting Privacy

   • Using Security Baselines
     • To provide starting point with minimum security standards
       • GPO
     • Security Control Baseline
   • Scoping and Tailoring
     • Review Security Baselines
     • Select only logically applicable controls to a system
   • Selecting Standards
     • Selecting Security Controls within the Baseline
       • ISO
       • PCI DSS
   • GDPR