InformationSecurity030

Data is an Asset

• True

• False

In order to construct an effective security plan, we need to look at how important the information is and draw some lines to separate by priority and importance. This process of categorization is known as the _____.

• Data Classification

• Information Classification

• Value Classification

• Technology Classification

• Security Classification

Data must be properly classified, and there must be a way to apply a static identification. We call this _____.

• Labeling

• Access Approval

• Clearance

• Authentication

• Authorization

The classified data will be assigned to appropriate roles to control and manage.

This is called _____.

• Labeling

• Access Approval

• Clearance

• Authentication

• Authorization

If someone has no clearance and attempt to obtain it, there must be a process to obtain it. This process is called _____.

• Labeling

• Access Approval

• Clearance

• Authentication

• Authorization

A new user or role must have specific boundaries when accessing and dealing with data. This is also defined in the classification and labeling process and then informed to the users upon granting access. They must stay in the boundaries to accept the provided AAA for the actions they perform.

AAA represents _____, _____ and _____.

• Accountablity

• Accessibility

• Approach

• Authentication

• Authorization

There are some important considerations when it comes to data classification.

• Disposal

• Data must be kept, especially for future use and upon regulatory requirements.

• Data Security

• Data disposal is important as it can lead to leak information/data. There must be secure and standardized procedures.

• Data Retention

• Data can be at rest, in motion or being used . Each stage must be protected.

• Encryption

• Roles and permissions

• Access privilege

• Depending on the type of data, regulatory requirements, and appropriate level of protection that must be ensured.

Match the following levels of data classifications

• SBU (Sensitive But Unclassified)

• If leaked, it can still cause a certain level of damage to a nation or a corporation.

• Confidential

• This type of data does not cause damage to a nation, but can affect people or entities. Health Information is a good example.

• Secret

• This is the second level of classification. If leaked it can still cause a significant damage to a nation or a corporation.

• Unclassified

• This is applied mainly to government and military data. If leaks, it can cause grave damage to an entire nation.

• Top Secret

• Data/information yet to be classified or does not need a classification as it does not include any sensitive data.

Match the following roles in protecting privacy

• Business/Mission Owners

• A custodian is a role responsible for delegated tasks. The person has to perform the hands-on duties such as backing up data, running recovery simulations, apply patches, and configuration.

• Data Custodian

• This is usually the management who is responsible for the security of the data they own or manage. They have to classify the data, label the data, and determine the retention, backup, disposal

  requirements. The owners do the management operations, not the technical part.

• Data Owners

• The top-level hierarchy who have the ultimate responsibility to initiate, implement a proper security program, fund the program, and ensure the organization follows.

• Users

• Is responsible for the assets that hold the data, the computer hardware, and related technologies. He has to properly maintain these systems to the standards (patching, updating, configuring, etc.)

• System Owner

• The general users who are using the systems. This is the weakest link. Therefore, they must be informed and taught about the data and protection specifically. They are responsible for complying with the policies, standards, procedures, etc. If they fail to meet the policies, they have to bear the consequences. The management must educate the users about penalties.

The data controller determines the purposes for which and the means by which personal data is processed.

• True

• False