CISSP DOMAIN 2: Asset Security

What are the four phases of the Information Lifecycle?

Data acquisition, Data use, Data archival, Data disposal

What is Data Acquisition?

Creating or copying data from another source

What is Data Use?

Ensuring confidentiality, integrity, and availability of data

What is Data Archival?

Retaining data for long-term storage based on legal or business requirements

What is the difference between archival and backup?

Archival is long-term retention; backup is for recovery purposes

What is Data Disposal?

Proper destruction of data to prevent unauthorized access

What is Top Secret classification (government)?

Exceptionally grave damage if disclosed

What is Secret classification (government)?

Serious damage if disclosed

What is Confidential classification (government)?

Damage if disclosed

What is Unclassified data?

No damage if disclosed

What is Confidential classification (private sector)?

Exceptionally grave damage if disclosed

What is Private classification (private sector)?

Serious damage if disclosed

What is Sensitive classification (private sector)?

Damage if disclosed

What is Public data?

No damage if disclosed

Who is the Data Owner?

Assigns data classification and defines backup requirements

Who is the Data Custodian?

Handles backups, restores, and system maintenance

Who is the System Owner?

Owns the systems that store data

Who is the Data Controller?

Determines how and why data is processed

Who is the Data Processor?

Processes data on behalf of the controller

What is Data Remanence?

Residual data left after deletion

What is ROM?

Nonvolatile memory that retains data after power loss

What is PROM?

Programmable read-only memory (programmable once)

What is EPROM?

Reprogrammable memory using UV light

What is EEPROM?

Electrically reprogrammable memory

What are PLDs?

Programmable logic devices configurable after manufacturing

What is RAM?

Volatile memory used for temporary storage

What is SRAM?

Fast, expensive memory using flip-flops

What is DRAM?

Slower, cheaper memory using capacitors

What is SDRAM?

Synchronized DRAM used in system memory

What is Cache memory?

High-speed memory close to CPU (L1 fastest, then L2)

What is Degaussing?

Destroying magnetic media using strong magnetic fields

What is Scoping?

Determining which parts of a standard apply to an organization

What is Tailoring?

Customizing a standard to fit an organization

What is Certification?

Verifying a system meets security requirements

What is Accreditation?

Data owner accepts risk and approves system for use

Who performs Accreditation?

Data owner

What is Digital Rights Management (DRM)?

Technology to protect copyrighted digital content

What is a Cloud Access Security Broker (CASB)?

Security layer between users and cloud apps for monitoring and enforcement

What is Data Loss Prevention (DLP)?

Tools to prevent unauthorized data exfiltration