CISM Certification Domain 1: Information Security Governance Video Boot Camp 2019 - Data Classification

The video tutorial discusses the concept of object subjects and clearance levels, emphasizing the importance of having appropriate clearance to access data. It explains military and business classification systems, the formal access approval process, and the need to know principle. A case study on a data breach at Kaiser Hospital highlights the consequences of unauthorized data access. The tutorial concludes with a discussion on access levels and the least privilege approach, comparing its use in military and private sectors.

What is required for a subject to access data according to the clearance level system?

• The subject's clearance must be lower than the data label.

• The subject must be in a managerial position.

• The subject's clearance must be equal to or higher than the data label.

• The subject must have a personal connection to the data owner.

What is a key factor in the formal decision to assign subject clearance?

• The subject's age

• The subject's financial status

• The subject's educational background

• The subject's current and future stress and stability

What does formal access approval entail?

• Access based on the subject's job title

• Automatic access to all data

• Approval from the data owner to access the data

• Access granted by a third-party organization

What principle is often implemented in role-based access control?

• Open access principle

• Need-to-know principle

• Universal access principle

• Random access principle

Which approach is more commonly used in the military or government sectors?

• Universal access

• Maximum privilege

• Least privilege

• Open access