InformationSecurity030

Data is an Asset

• True

• False

In order to construct an effective security plan, we need to look at how important the information is and draw some lines to separate by priority and importance. This process of categorization is known as the _____.

• Data Classification

• Information Classification

• Value Classification

• Technology Classification

• Security Classification

Data must be properly classified, and there must be a way to apply a static identification. We call this _____.

• Labeling

• Access Approval

• Clearance

• Authentication

• Authorization

The classified data will be assigned to appropriate roles to control and manage.

This is called _____.

• Labeling

• Access Approval

• Clearance

• Authentication

• Authorization

If someone has no clearance and attempt to obtain it, there must be a process to obtain it. This process is called _____.

• Labeling

• Access Approval

• Clearance

• Authentication

• Authorization

A new user or role must have specific boundaries when accessing and dealing with data. This is also defined in the classification and labeling process and then informed to the users upon granting access. They must stay in the boundaries to accept the provided AAA for the actions they perform.

AAA represents _____, _____ and _____.

• Accountablity

• Accessibility

• Approach

• Authentication

• Authorization

There are some important considerations when it comes to data classification.

• Disposal

• Data can be at rest, in motion or being used . Each stage must be protected.

• Encryption

• Depending on the type of data, regulatory requirements, and appropriate level of protection that must be ensured.

• Data Security

• Data disposal is important as it can lead to leak information/data. There must be secure and standardized procedures.

• Data Retention

• Roles and permissions

• Access privilege

• Data must be kept, especially for future use and upon regulatory requirements.

Match the following levels of data classifications

• Secret

• If leaked, it can still cause a certain level of damage to a nation or a corporation.

• Top Secret

• Data/information yet to be classified or does not need a classification as it does not include any sensitive data.

• Unclassified

• This type of data does not cause damage to a nation, but can affect people or entities. Health Information is a good example.

• SBU (Sensitive But Unclassified)

• This is the second level of classification. If leaked it can still cause a significant damage to a nation or a corporation.

• Confidential

• This is applied mainly to government and military data. If leaks, it can cause grave damage to an entire nation.

Match the following roles in protecting privacy

• Data Custodian

• The general users who are using the systems. This is the weakest link. Therefore, they must be informed and taught about the data and protection specifically. They are responsible for complying with the policies, standards, procedures, etc. If they fail to meet the policies, they have to bear the consequences. The management must educate the users about penalties.

• Data Owners

• Is responsible for the assets that hold the data, the computer hardware, and related technologies. He has to properly maintain these systems to the standards (patching, updating, configuring, etc.)

• Business/Mission Owners

• A custodian is a role responsible for delegated tasks. The person has to perform the hands-on duties such as backing up data, running recovery simulations, apply patches, and configuration.

• Users

• The top-level hierarchy who have the ultimate responsibility to initiate, implement a proper security program, fund the program, and ensure the organization follows.

• System Owner

• This is usually the management who is responsible for the security of the data they own or manage. They have to classify the data, label the data, and determine the retention, backup, disposal

  requirements. The owners do the management operations, not the technical part.

The data controller determines the purposes for which and the means by which personal data is processed.

• True

• False