GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

Asset Security

Alex Proctor Information Security CISSP English 58 cards

Cards in this deck (58)

  1. 1Information Life CycleAcquisition, use, archival, disposal
  2. 2BackupCopy of data set currently in use that is made for the purpose of recovering from the loss of the original data
  3. 3ArchiveCopy of data set that is no longer in use, but is kept in case it is needed at some point. Usually removed from original location.
  4. 4Information SensitivityForm of information classification. Commensurate with the losses to an organization if that information was revealed to unauthorized individuals.
  5. 5Information CriticalityForm of information classification. Indicator of how the loss of the information would impact the fundamental business processes of the organization.
  6. 6Common Classification Levels - CommercialConfidential, private, sensitive, public
  7. 7Common Classification Levels - MilitaryTop secret, secret, confidential, sensitive but unclassified, unclassified
  8. 8Classification - Data AggregationData aggregation may lead to an increase in classification levels.
  9. 9Chief Executive Officer (CEO)Responsible for day-to-day management and strategic vision of an organization. Often the chairperson of the board of directors and the highest-ranking officer in the company.
  10. 10Chief Financial Officer (CFO)Responsible for the corporation's accounting and financial activities, and the overall financial structure of the organization.
  11. 11Chief Information Officer (CIO)Responsible for the strategic use and management of information systems and technology. Usually reports to the CEO or CFO.
  12. 12Chief Privacy Officer (CPO)Responsible for ensuring that customer, company, and employee data is kept safe. Often an attorney. Usually reports to the CSO
  13. 13Chief Security Officer (CSO)Responsible for understanding the risks that the company faces and mitigating the risks to an acceptable level. Responsible for understanding business drivers, and for creating and maintaining a security program that facilitates the drivers.
  14. 14Privacy vs. SecurityPrivacy indicates the amount of control an individual should have over their own information. Security refers to the mechanisms that can be put into place to provide this level of control.
  15. 15CSO vs. CISOCSO role usually has a further-reaching list of responsibilities than CISO. CISO is usually more focused on technology and has an IT background. If both exist, CISO reports to CSO.
  16. 16ConvergenceFormal cooperation between previously disjointed security functions. Primarily a responsibility of the CSO.
  17. 17Data OwnerResponsible for the protection and use for a specific subset of information. Usually a member of management who is in charge of a specific business unit.
  18. 18Data CustodianResponsible for maintaining and protecting a specific subset of data. Usually a member of IT or security department.
  19. 19System OwnerResponsible for one or more systems, each of which may hold and process data owned by different data owners.
  20. 20Security AdministratorResponsible for implementing and maintaining security network devices and software.
  21. 21Security Administrator vs. Network AdministratorSecurity administrator is focused on keeping the network secure, network administrator is most focused on keeping the network up and running.
  22. 22SupervisorResponsible for all user activity and any assets created and owned by these users. Also known as a user manager.
  23. 23Change Control AnalystResponsible for approving or rejecting requests to make changes to networks, systems, or software.
  24. 24Data AnalystResponsible for ensuring that data is stored in a way that makes the most sense to the company and individuals who need to work with it.
  25. 25UserAny individual who routinely uses the data for work-related tasks.
  26. 26AuditorResponsible for ensuring that the organization complies with its own policies, as well as applicable laws and regulations.
  27. 27Data Retention Policy - 3 Fundamental QuestionsWhat data do we keep? How long do we keep this data? Where do we keep this data?
  28. 28Data Retention - TaxonomyScheme for classifying data. Classification can be made using a variety of categories, including functional, chronological, organizational, or any combination thereof.
  29. 29Data Retention - ClassificationSensitivity classification of data determines the controls placed on it while in use and when archived.
  30. 30Data Retention - NormalizationTagging schemes which are intended to make a variety of types of stored data searchable.
  31. 31Data Retention - IndexingUtilized to ensure stored data is quickly searchable.
  32. 32e-discoveryProcess of producing for a court or attorney all ESI (electronically stored information) pertinent to a legal proceeding.
  33. 33Electronic Discovery Reference Model (EDRM)Identification, preservation, collection, processing, review, analysis, production, presentation.
  34. 34Data RemeranceResidual representation of digital data that remains even after attempts have been made to remove or erase the data.
  35. 35NIST SP 800-88, Revision 1Describes best practices for combatting data remanence in "Guidelines for Media Sanitization".
  36. 36Data Removal - OverwritingReplacing 1's and 0's with random or fixed patterns of 1's and 0's. Should be done at least once, but may have to be done more than that.
  37. 37Data Removal - DegaussingRemoving or reducing the magnetic field patterns on conventional disk drives or tapes. Magnetic force is applied to the media, wiping the data.
  38. 38Data Removal - EncryptionEncryption key is deleted, rendering encrypted data unusable. Often used on mobile devices.
  39. 39Data Removal - Physical DestructionPhysical media is destroyed. Common approaches include shredding, exposure to caustic or corrosive chemicals, and incineration.
  40. 40Data at RestData residing in external or auxiliary storage devices, such as HDD's, SSD's, CD/DVD's, or magnetic tape. Best-protected by encryption. Most OS's support whole disk encryption.
  41. 41Data in MotionData moving between computing nodes over a data network such as the internet. Best-protected by encryption. (TLS, IPSec, VPN's, etc.)
  42. 42Data in UseData residing in primary storage devices, such as RAM, memory caches, or CPU registers. Generally cannot be protected by encryption.
  43. 43Side-ChannelAny information flow that is the electronic byproduct of the cryptographic process.
  44. 44Side-Channel AttackExploits information that is leaked by a cryptosystem.
  45. 45Media Labeling - 6 Included ElementsDate created, retention period, classification level, creator, date to be destroyed, name and version
  46. 46Data Loss Prevention (DLP)Actions that organizations take to prevent unauthorized external parties from gaining access to sensitive data.
  47. 47Data Loss vs. Data LeakData loss means that we do not know where the data is, data leak means that the confidentiality of the data has been compromised.
  48. 48SteganographyProcess of hiding data within other data that is difficult or impossible to detect the hidden content.
  49. 49Data Protection - Areas to ConsiderBackup and recovery, data life cycle, physical security, security culture, privacy, organizational change.
  50. 50DLP Solution - Important ElementsSensitive data awareness, policy engine, interoperability, accuracy.
  51. 51Misuse CasesDescriptions of threat actors and the threats they want to perform on the system. Related to "use cases".
  52. 52Use CasesUsed by system analysts to document the tasks that authorized actos want to perform on a system.
  53. 53Network DLP (NDLP)Applies data protection policies to data in motion.
  54. 54Endpoint DLP (EDLP)Applies protection policies to data and rest and data in use.
  55. 55Hybrid DLPNDLP and EDLP are both deployed across the enterprise.
  56. 56Safes - 5 TypesWall safe, floor safe, chests, depositories, vaults
  57. 57Safes - Passive RelockingExtra lock is implemented when tampering is detected.
  58. 58Safes - Thermal RelockingExtra lock is implemented what certain temperature is met (possibly from drilling).

Information

Description
CISSP Information Security Flashcards on Asset Security, created by Alex Proctor on 21/10/2016.
Created by
Alex Proctor
Views
2
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?