Cissp

Front 1

Asset

Back 1

Anything of value to an organization such as their people, partners, facilities, reputation, and information

Front 2

The Information Life Cycle

Back 2

Aquisition, Use, Archival, and Disposal.

Front 3

During the aquisition phase what are the 2 ways a company aquire data?

Back 3

They can create it from scratch or copy it from somewhere else.

Front 4

Use - Info Life Cycle

Back 4

Presents the most challenges in terms of CIA triangle. Use Phases must be mapped to appropriate internal policies, regulations and laws.

Front 5

Archival - Info Life Cycle

Back 5

Phases where we are considering getting rid of the information but we may have regulatory or industry huifelines that require the information to be held for a specific time period.

Front 6

Backup vs Archive

Back 6

Backup is made up of current data for the purpose of recovering from the loss of original data. While archive is data that is no longer in use but is kept for some point in the future.

Front 7

Disposal - Info Life Cycle

Back 7

This involves properly getting rid of the data. The two most things to consider are: ensuring the data truly gets destroyed and that it gets destroyed in accordance with the proper regulations and laws.

Front 8

What are 4 common commercial data classification levels?

Back 8

Confidential, Private, Sensitive, and Public

Front 9

Example of public classification.

Back 9

Any disclosure is not warranted but this would not cause an adverse impact to the company or its personnel.

Front 10

Example of sensitive classification.

Back 10

Requires special precautions to ensure the integrity and confidentiality of the data. Such as financial information, project details, and profit earnings.

Front 11

Example of private classification

Back 11

Personal information for use within a company. Unauthorized disclosure could adversely affect personally of the company. Examples are HR information, medical information, and work history.

Front 12

Example of confidentiality of data.

Back 12

For use within the company only. Data is example from Freedom of Information Act and other laws and regulations. Examples include trade secrets, programming code, healthcare, information that keeps the company competitive.

Front 13

What is Unclassified info?

Back 13

Data is not sensitive or classified. Examples are computer manuals, warranty info, recruiting information.

Front 14

What is Sensitive but Unclassified info?

Back 14

Minor secret, if disclose it may not cause major damage. Examples include medical data, answers to test scores.

Front 15

What is Secret classification?

Back 15

If disclose it could cause serious damage to national security. Examples are deployment plans for troops, unit readiness.

Front 16

What is Top Secret classification?

Back 16

If disclosed, it could cause grave damage to national security. Examples include blueprints of new weapons, spy satelilites information, espionage data.

Front 17

What are a few classification controls?

Back 17

Marking, labeling, and handling procedures, strict access control for all users levels, encryption of data, auditing and monitoring access, separation of duties, period reviews, backup n recovery procedures, change control process, and proper disposal.

Front 18

Name the Executive Team

Back 18

Ceo, Cfo, CIO that reports to them

Front 19

What are the duties of Chief Privacy Officer?

Back 19

Newer position that ensures customer, company, employee data has policy that explains how it collects, protects, or gives out data to 3rd parties.

Front 20

Chief Security Officer

Back 20

Responsible for understanding the risk involve with a company and lowing it to an acceptable level.

Front 21

Data Owner

Back 21

Usually a member of management who is in charge of a specific business unit and ultimately responsible for the protection and use of a data subset.

Front 22

Data Custodian

Back 22

Responsible for maintaining and protecting the data such as implementing security on controls, backing up data, periodically performing data Intergrity checks.

Front 23

Security Administrator

Back 23

Responsible for setting up security network devices such as firewalls, ids, ips, and antimalware.

Front 24

User

Back 24

Any individual who uses the data in the course of work.

Front 25

Auditor

Back 25

Checks to make everyone is doing his or her job and ensures the correct security controls are in place.

Front 26

What are the three parts of Data retention?

Back 26

What data do we retain, how long do we retain it and where and what format do we retain data.

Front 27

What is an e-discovery?

Back 27

When a court makes a require for an organization to produce electronically stored information pertinent in to a legal proceeding.

Front 28

What Nist document talks about sanitizing data?

Back 28

NIST 800-88 Guidelines for Media Sanitation

Front 29

Data Ramanence Approaches

Back 29

Overwriting at least 7 times, Degaussing with magnetic erasing data, Encryption then properly and securely delete the keys, Physical destruction of data

Front 30

What is the best way to combat data Ramanence?

Back 30

Physical destroying data by shredding, fire, or expose to chemicals.

Front 31

How to secure data at rest?

Back 31

Encryption and whole-disk encryption for portable computing devices.

Front 32

How to secure data in motion?

Back 32

Using Encryption methods such as TLS (Transport Layer Security) and IPSec are good for transit data. VPN is good solution for tunneling users from home.

Front 33

How to secure data in use?

Back 33

This is when data is on your screen or stored on devices such as RAM, memory caches or CPU registers. To secure you must prevent side channel attack exploits such as the Heartbleed bug of 2014. Whole-memory encryption is also a solution.

Front 34

Should all media be clearly marked and logged?

Back 34

Yes.

Front 35

What is sanitized media?

Back 35

Media that has been erased but is only acceptable when media will be reused in the same physical environment.

Front 36

What are some media controls that can help to secure disk drives, USB, thumb drives, laptops, dvds, cds, and serves blades?

Back 36

Tracking ownership at any moment, access control, knowing the number and backup versions, changes made to the device, ensuring environment conditions don't impact media ensuring media integrity, inventory the data, use secure disposal activities, internal and external labeling.

Front 37

3 requirements for Data Leakage

Back 37

It has to involve data that is Sensitive, it has to be to an unauthorized system or individual, to an external party outside of the company.

Front 38

What should you understand to prevent data leakage?

Back 38

How data flows, data inventoryed showing what data is important and what's not, the data protection strategy ie data life cycle or backup recovery process etc, network dlp, endpoint dlp, hybrid dlp