Scribd
Upload
11 views

Isc2 Cissp 2 7 1 Asset Security Key Points

The document outlines 17 key points related to asset security that are important to understand for the CISSP exam. It covers topics such as data classification, data lifecycles, asset inventory and labeling, roles in data management, data states, encryption methods, standards, and data protection methods for data at rest, in motion, and in use. Understanding these points will help prepare for successfully passing the CISSP exam.

Uploaded by

trojanbaya
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
11 views

Isc2 Cissp 2 7 1 Asset Security Key Points

The document outlines 17 key points related to asset security that are important to understand for the CISSP exam. It covers topics such as data classification, data lifecycles, asset inventory and labeling, roles in data management, data states, encryption methods, standards, and data protection methods for data at rest, in motion, and in use. Understanding these points will help prepare for successfully passing the CISSP exam.

Uploaded by

trojanbaya
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Asset Security Key Points

Objectives:

At the end of this episode, I will be able to:

Understand and identify the key points and items from Domain 2 that need to be
mastered as part of your preparation to take and pass the CISSP exam.

External Resources:

Asset Security - Key points

1. Classification & Categorization

2. How to manage sensitive information

3. Data / Retention policies

4. Data Policy

5. Asset Inventory | Classification | Labeling | Handling

Data classification schemes (2 types - Government & Private Sector)

6. NIST NICE Framework: Securely Provision (SP) NICE Specialty Areas

a. Risk Management (RSK)


b. Software Development (DEV)
c. Systems Architecture (ARC)
d. Technology R&D (TRD)
e. Systems Requirements Planning (SRP)
f. Test & Evaluation (TST)
g. Systems Development (SYS)

7. Data Lifecycle Management (DLM) vs Information Lifecycle Management (ILM)

8. Data Management Lifecycle (PLAN + 5 phases)

9. PLAN FIRST !!

a. Data Creation
b. Storage
c. Usage/Share
d. Archival
e. Destruction

9. QA (external) vs. QC (internal) & Collection Limitation on data

10. Roles to know:

a. data subject - subject of personal data


b. data owner - master of all
c. data controller - determines processing purpose(s)
d. data processor - managers of all (on behalf of the controller)
e. data custodian - custody, transport, storage & business rules
f. data steward - fitness of data elements
g. administrator - grants permissions / access to data

11. Data, data, data - Remanence & Sanitization

a. clearing
b. purging
c. destruction
e. simple delete = erase
f. destruction - types
Overwriting
Degaussing
Encryption
Crypto-Shredding
Physical Destruction
Chemical Alteration
Phase Shift / transition (Curie Temp)
SSD vs HDD

*** Cloud data - encrypt data while in storage and use ==> upon exit crypto-shred
remaining data

12. Asset Retention - What are the Stages?

• GA / Sale Date
• End of Life / End of Sale
• End of Development
• End of Service Life / End of Support

13. End-of-Life Management

• Maintaining inventories
• Approved end-of-life or sunset policy
• Tracking changes, availability of updates, and end of support
• Risk assessments to determine end-of-life
• Plan for the replacement of systems and comply with policy requirements
• Procedures for secure destruction or data wiping of hard drives

14. Data states

Data exists in 3 well defined states:

a. at rest (storage)
b. in motion (transit / on the wire)
c. in use (application in memory)

15. Link vs End-to-End encryption

16. Scoping & Tailoring (Supplementation)

17. Standards...

18. Data protection methods (Digital Rights Management (DRM), Data Loss
Prevention (DLP), Cloud Access Security Broker (CASB))

a. at rest (storage) -
encryption
obfuscation / tokenization
archive / dispose / destruct
mobile device protection
physical media control

b. in motion (transit) -
encryption
perimeter security
web content filtering
network traffic monitoring
VPN's

c. in use (application) -
encryption
user monitoring
workstation restrictions
application controls (whitelist / blacklist)
data labeling

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy