CISSP (8 Domain)

Certified Information Systems

Security Professional

Instructor : Do Duc Huy

CISSP, CISA, CEH, CCSP, CCNP, RSA CSP
huydd79@gmail.com
Module 2

CISSP – ASSET SECURITY

 CONTENT

 Roles within an Organization

 Classification of Data

 System Baselining and Hardening

 States of Data

3
 ROLES AND RESPONSIBILITIES

 Senior/Executive Management
 CEO: Chief Decision-Maker
 CFO: Responsible for budgeting and finances
 CIO: Ensures technology supports company's objectives
 ISO: Risk Analysis and Mitigation
 Steering Committee: Define risks, objectives and approaches
 Auditors: Evaluates business processes
 Data Owner: Classifies Data
 Data Custodian: Day to day maintenance of data
 Network Administrator: Ensures availability of network resources
 Security Administrator: Responsible for all security-related tasks, focusing
on Confidentiality and Integrity
4
 AUDITING ROLE

 Objective Evaluation of controls and policies to ensure that they are

being implemented and are effective.
 If internal auditing is in place, auditors should not report to the head of
a business unit, but rather to legal or human resources--some other
entity with out direct stake in result

5
 DATA CLASSIFICATION

 Development of sensitivity labels for data and the assignment of those

labels for the purpose of configuring baseline security based on value
of data
 Cost: Value of the Data
 Classify: Criteria for Classification

 Controls: Determining the baseline security configuration for each

 Data Owner determines the classification of data

 Data Custodian maintains the data

6
 CONSIDERATIONS FOR ASSET
VALUATION
 What makes up the value of an asset?
 Value to the organization
 Loss if compromised

 Legislative drivers

 Liabilities

 Value to competitors

 Acquisition costs

 And many others

7
 SENSITIVITY VS. CRITICALITY

 Sensitivity describes the amount of damage that would be done

should the information be disclosed
 Criticality describes the time sensitivity of the data. This is usually
driven by the understanding of how much revenue a specific asset
generates, and without that asset, there will be lost revenue

8
 DATA OWNERSHIP
 Three roles
 Data owner
 Data custodian

 Data user

9
 DATA OWNER
 The Data Owner is normally the person responsible for, or dependent upon the business
process associated with an information asset. The Data Owner is knowledgeable about
how the information is acquired, transmitted, stored, deleted, and otherwise processed.
 The Data Owner determines the appropriate value and classification of information
generated by the owner or department;
 The Data Owner must communicate the information classification when the information
is released outside of the department and/or Sample;
 The Data Owner controls access to his/her information and must be consulted when
access is extended or modified; and
 The Data Owner must communicate the information classification to the Data Custodian
so that the Data Custodian may provide the appropriate levels of protection.

10
 DATA CUSTODIAN

 The Data Custodian maintains the protection of data according to the

information classification associated to it by the Data Owner.
 The Data Custodian role is delegated by the Data Owner and is
usually Information Technology personnel.

11
 DATA USER

 The Data User is a person, organization or entity that interacts with

data for the purpose of performing an authorized task.
 A Data User is responsible for using data in a manner that is
consistent with the purpose intended and in compliance with policy.

12
 DATA CLASSIFICATION
 Government and military
 Top secret
 Secret

 Confidential

 Sensitive but unclassified

 Unclassified

 Commercial and Private sectors

 Confidential
 Private

 Sensitive

 Public

13
 GOVERNMENT AND MILITARY

 Top Secret The highest level of classification. The unauthorized disclosure of top-secret
data will have drastic effects and cause grave damage to national security.
 Secret Used for data of a restricted nature. The unauthorized disclosure of data
classified as secret will have significant effects and cause critical damage to national
security.
 Confidential Used for data of a private, sensitive, proprietary, or highly valuable nature.
The unauthorized disclosure of data classified as confidential will have noticeable effects
and cause serious damage to national security. This classification is used for all data
between secret and sensitive but unclassified classifications.
 Unclassified The lowest level of classification. This is used for data that is neither
sensitive nor classified. The disclosure of unclassified data does not compromise
confidentiality or cause any noticeable damage.

14
 COMMERCIAL

 Confidential The highest level of classification. This is used for data that is extremely
sensitive and for internal use only. A significant negative impact could occur for a
company if confidential data is disclosed. Sometimes the label proprietary is substituted
for confidential. Sometimes proprietary data is considered a specific form of confidential
information. If proprietary data is disclosed, it can have drastic effects on the competitive
edge of an organization.
 Private Used for data that is of a private or personal nature and intended for internal use
only. A significant negative impact could occur for the company or individuals if private
data is disclosed.
 Sensitive Used for data that is more classified than public data. A negative impact could
occur for the company if sensitive data is disclosed.
 Public The lowest level of classification. This is used for all data that does not fit in one
of the higher classifications. Its disclosure does not have a serious negative impact on
the organization..
15
 CONFIDENTIAL DATA

 Minimum Labeling Requirements for Confidential Data

 If possible, all Confidential Data must be marked, regardless of the form it takes.
 Confidential Data will be marked using the word “Confidential” in bold, italicized, red font (i.e.
Confidential).
 The marking should be placed in the right corner of the document header or footer.

16
 STATES OF DATA

 At Rest:
 File System Encryptions, EFS, TPM
 In Process:
 Process protection, memory protection
 In Transit:
 IPSec, SSL/TLS

17
 MEMORY AND REMANENCE

 Data Remanence
 Memory
 Cache Memory; fast and close to CPU

 register file (contains multiple registers);

registers are small storage locations used
by the CPU to store instructions and
small amounts of data
 Level 1 cache; located on the CPU

 Level 2 cache; connected to (but not on)

the CPU
 SRAM (Static Random Access Memory)

18
 MEMORY AND REMANENCE

 Memory
 RAM (Random Access Memory)
 Volatile
 Modules installed in slots on motherboard
(traditionally)
 DRAM (Dynamic Random Access Memory)
 Slower and cheaper
 Small capacitors to store bits (data)
 Capacitors leak charge and must be continually
refreshed
 SRAM (Static Random Access Memory)
 Fast and expensive
 Latches called “flip-flops” to store bits (data)
 Does not require refreshing
19
MEMORY AND REMANENCE
 MEMORY AND REMANENCE
 Memory
 ROM (Read Only Memory)
 Can be used to store firmware; small programs that don’t change much and configurations
 PROM (Programmable Read Only Memory) – written to once; usually by the manufacturer
 EPROM (Erasable Programmable Read Only Memory) – can be “flashed”; usually with
ultraviolet light
 EEPROM (Electrically Erasable Programmable Read Only Memory) – can be “flashed”;
electrically
 PLD (Programmable Logic Device) – field-programmable device; EPROMs, EEPROMs, and
Flash Memory are all PLDs
 Flash Memory
 Can be a security nightmare
 Specific type of EEPROM
 Written in larger sectors (or chunks) than other EEPROMs
 Faster than other EEPROMS, but slower that magnetic drives

21
 MEMORY AND REMANENCE
 Memory
 Solid State Drives (SSDs)
 Combination of EEPROM and DRAM
 Sanitization can be a challenge
 Garbage collection - working in the background, garbage collection systematically identifies which
memory cells contain unneeded data and clears the blocks of unneeded data during off-peak times
to maintain optimal write speeds during normal operations.
 TRIM command - (known as TRIM in the ATA command set, and UNMAP in the SCSI command
set) allows the operating system to inform a solid-state drive (SSD) which blocks of data are no
longer considered in use and can be wiped internally.
 ATA Secure Erase can be used to remove data securely

22
 DATA DESTRUCTION
 Deleting data and/or formatting a hard drive is not a
viable/secure method for destroying sensitive information.
 Deleting a file only removes the entry from the File
Allocation Table (FAT) and marks the block as
“unallocated”. The data is still there and often times it’s
retrievable.
 Reformatting only replaces the old FAT with a new FAT.
The data is still there and often times it’s retrievable.
 Data that is left over is called remnant data, or “data
remanence”.
 Hundreds of data recovery tools available, one good
resource to check out is ForsensicsWiki.org
(http://www.forensicswiki.org/wiki/Tools:Data_Recovery)

23
 DATA DESTRUCTION
 Overwriting
 Also called shredding or wiping
 Overwrites the data and removes the FAT entry
 Secure overwriting/wiping overwrites each sector of a hard
drive (or media).

24
 DATA DESTRUCTION
 Overwriting
 One pass is enough (as long as each sector is overwritten).
 Tools include Darik's Boot And Nuke (DBAN), CBL Data
Shredder, HDDErase,KillDisk and others.
 Windows built-in cipher command.

25
 DATA DESTRUCTION
 Degaussing
 Destroys the integrity of magnetic media using a strong
magnetic field
 Most often destroys the media itself, not just the data

26
 DATA DESTRUCTION
 Destruction (Physical)
 The most secure method of destroying data.
 Physical destruction of the media.
 Incineration, pulverization, shredding, and acid.
 A hammer to the spindle works, and so does a rifle. Pretty
cheap nowadays. Look for a National Association of
Information Destruction (NAID) certified vendor and get a
certificate of destruction.
 Onsite vs. offsite

27
 DATA DESTRUCTION
 Shredding
 Most people think of paper.
 Strip-cut vs. Cross-cut
 A determined attacker can defeat
(maybe)
 Easy to audit
 Many breaches attributed to poor
document disposal
 Dumpster diving

28
 SYSTEM HARDENING & BASELINING

 Removing unnecessary services

 Installing the latest services packs and patches

 Renaming default accounts

 Changing default settings

 Enabling security configurations like auditing, firewalls, updates, etc..

 ***Don’t forget physical security!***

29
 CONFIGURATION MANAGEMENT
 Defined by ISC2 as “a process of identifying and documenting hardware
components, software and the associated settings.”
 The goal is to move beyond the original design to a hardened,
operationally sound configuration
 Identifying, controlling, accounting for and auditing changes made to the
baseline TCB
 These changes come about as we perform system hardening tasks to
secure a system.
 Will control changes and test documentation through the operational life
cycle of a system
 Implemented hand in hand with change control
 ESSENTIAL to Disaster Recovery

30
 CONFIGURATION MANAGEMENT
DOCUMENTATION
 Make
 Model

 MAC address

 Serial number

 Operating System/Firmware version

 Location

 BIOS or other passwords

 Permanent IP if applicable

 Organizational department label

31
 CHANGE MANAGEMENT

 Directive, Administrative Control that should be incorporated into

organizational policy.
 The formal review of all proposed changes--no “on-the-fly” changes

 Only approved changes will be implemented

 The ultimate goal is system stability

 Periodic reassessment of the environment to evaluate the need for

upgrades/modifications

32
 THE CHANGE MANAGEMENT
PROCESS
 Request Submittal
 Risk/Impact Assessment

 Approval or Rejection of Change

 Testing

 Scheduling/User Notification/Training

 Implementation

 Validation

 Documentation

33
 PATCH MANAGEMENT

 An essential part of Configuration and Change Management

 May come as a result of vendor notification or pen testing

 Some sources
 cve.mitre.org (Common Vulnerability and Exposures) database provides
standard conventions for known vulnerabilities
 nvd.nist.gov Enables automation of vulnerability management, security
measurement, and compliance. NVD includes databases of security
checklists, security related software flaws, incorrect configurations,
product names, and impact metrics.
 www.cert.gov: Online resource concerning common vulnerabilities and
attacks
34
MODULE REVIEW
 CHAPTER 2 ASSET SECURITY REVIEW

 Roles within an Organization

 Classification of Data

 System Baselining and Hardening

 States of Data

36
MODULE SELF CHECK
MODULE SELFCHECK

38
MODULE SELFCHECK

39
40
41
42
43
http://vnomega01.ddns.net/download/cissp/2017books.7z
vnomeg@01

44