Domain 2: Asset Security Saved
Topic Subtopic Connection Icon Note
Top secret - grave image
Secret - serious image
Government
Confidential - damage
Unclassified - Available to anyone
with free of info act (FOIA)
Data Classifcation
Confidential/Proprietary - grave
image [trade secret]
Private - serious damange [PII,PHI]
Non-government
Sensitive - damage [internal network]
Public - no damage [website]
1. Create an Asset Inventory - HW (barcode,
RFID), SW(Software Configuration, AD,LDAP,
nmap, software license, DLP), network logs
2. Assign Ownership
Asset Classification Process
3. Classify based on value. Tips: MIX
classification use highest level security
4. Protect based on classification
5. Assess and Review
Cloud access security broker (CASB) -
monitor user activity and central
control to enforce security
Data Loss Prevention (DLP) -
endpoint, network, states (rest,
transit, use)
Digital right management (DRM) -
copyright, watermark
Pseudonymization - alias represents data
Tokenization - random string represents data
Anonymization - remove all PII data
until can't identify subject
(Irréversible)
marking - physical marking of asset in
human readable form
labelling - associate with security
attributes. Metadata help DLP to flag
Scoping (which) - select part of control
Tailoring (fit)- modify control to
align org's mission, better address
with org's environment
Comment 0 Export as PNG Share
Link 50% Theme Tips
Owner - info classifying, control selection, identify
Laws - OECD guideline, GDPR, EU-US standard, set rules of protection by senior management
Privacy shield
Business owner - balance need of security control (CBA)
System owner - responsible for the
system on protection the data
Controller - decide what&how data process
Data Roles Processor - third party handling data as
behalf of owner, cloud, healthcare, bank
Custodian - day2day responsibilities
of protection data, IT department
Auditor - evaluate security controls
User - responsible protection of data in use, due care
Administrator - grant access
1. collection - min sensitive info
At rest - db, hard drive AES encryption (TPM, self
encryption drive SED, file level encryption)
2. location - store In motion - tls/ssl, VPN, link encryption
(routing point), end-to-end encryption
Domain 2:
Asset
In use - RAM, caches, registers
Security
3. maintenance - use and share, scrub
data and remove data
EOL - no new product
4. retention - archive. Period based (prepare to discontinue)
on regulatory, policy. Don't keep it
if don't need it EOS - no more support
(end life of product)
Data protection
Data lifecyle 5. remanence - destroy. Tips: get a new
drive is more cost effective and data
remanence is hard to get rid sometime
Erasing/Delete file (recoverable) - least
effective, data remain on drive
Clearing/Sanitization - prepare for
reuse. Overwrite with random bits
Purging (not recoverable) - intensive form of
Asset handling clearing for resuse in lower security level. E.g
6. destruction zeroization, crypto shredding, degaussing
Degaussing - tapes, magnetic disk. Not
apply to optical disk, SSD
Requirements Destruction (cannot reuse) - SSD acidic
spoil, shredding, incineration (burnt),
disintegration (pieces), most secure