Please enable JavaScript.

Coggle requires JavaScript to display documents.

CISSP Domain - 2 - Asset Security - To ensure that information assets are…

- - - - Public
        
        Info anyone can access
        
        Press releases, marketing materials.
      - Private
        
        Only employees can access
        
        Internal memos, Intranet docs.
      - Confidential
        
        Sensitive data
        
        Customer Info, Internal Reports
      - Secret or Highly Confidential
        
        Very Sensitive
        
        Trade secrets, Source code, HR records
      - Top Secret
        
        National Security or Critical systems data
        
        Government docs
    - - Use
        
        Accessed for work
        
        Apply access control
      - Share/ Transfer
        
        Sent to others
        
        Encrypt, Label
      - Store
        
        Saved on disk, Cloud, DB
        
        Encrypt, Back up
      - Archive
        
        Rarely used but still kept
        
        Retain per policy
      - Destroy
        
        No longer needed
        
        Sanitize or shred.
      - Create/ Collect
        
        Data is born
        
        Classify it immediately
    - - Value
      - Sensitivity
      - Criticality
  - - - Software - Applications, licenses, source code
      - People - Employees with skills and knowledge
      - Hardware - Servers, Laptops, routers
      - Facilities - Buildings, Data centers
      - Data/ Information - Docs, DBs, Logs
    - - Qualitative
        
        Measured in Money -Cost of loss, Downtimes, replacement
      - Quantitative
        
        Descriptive - High/Medium/low impact
  - - - Performs daily handling- Backups, Access Provisioning, labeling, patching.
    - - Manages the system that stores/processes the data, Implements technical controls.
    - - Uses the data properly under policy - Follows least privileges and no sharing without approval.
    - - Ensures Compliance with laws like GDPR, HIPAA. Manages data protection impact assessments.
    - - Decides classification level, Defines access rights, approves sharing, ensures compliance.
        
        Logic
        
        Custodian → implements controls, manages day-to-day tasks.
        
        System Owner → maintains the systems that host the data.
        
        Privacy Officer → ensures compliance with privacy laws.
        
        ✅ Data Owner → ultimately responsible for how the data is protected and who can use it.
- - - - Data at Rest
        
        Stored Data
        
        Encryption (AES -256), File permissions, Physical security
      - Data in Transit
        
        Data moving across networks
        
        TLS/SSL, VPNs, SSH, Secure APIs
      - Data in Use
        
        Data being processed in memory or applications
        
        Memory protection, data masking, secure enclaves
    - - Access Controls Lists (ACLs)
      - Encryption
      - Data Loss prevention
      - Strong authentication
      - Secure Backups
    - - To protect
        
        Labeling
        
        Every file or doc should be labeled per classification.
        
        Types
        
        Manual
        
        Automated
        
        Logging and Auditing
        
        Track who accessed or modified data.
        
        Handling procedures
        
        Define how to store, transmit, and dispose of data.
    - - Declassification
        
        Downgrade sensitivity when appropriate
      - Destruction
        
        Physically destroy media
      - Sanitization
        
        Secure erase or overwrite data.
- - - - PII
        
        Personally Identifiable Information
        
        Any info that can Identify a person. Like Name, address, SSN, email.
        
        Types
        
        Non Sensitive PII
        
        Sensitive PII
      - PHI
        
        Protected Health Information
        
        Health related personal data like Medical records, Insurance info
        
        HIPAA
        
        HITECH
  - - - Purpose Limitation
        
        Use data only for the purpose stated when collected
      - Consent
        
        Obtain individual consent before collecting/ processing data
      - Data Minimization
        
        Collect only what's necessary for a specific purpose
      - Retention Limitation
        
        Keep data only as long as needed
      - Accuracy
        
        Keep information up to date and correct
      - Integrity and Confidentiality
        
        Protect against unauthorized access, use, or destruction.
      - Accountability
        
        Organization must prove compliance with privacy rules.
  - - - EU - Gives individuals strong control over their personal data.
        
        Certain rights
        
        Right to Erasure
        
        Right to Rectification
        
        Right to Restrict or object to processing
        
        Right to restrict or object to processing
        
        Right to Access
        
        Right to Data Portability
    - - U.S Healthcare
        
        Protects medical information (PHI)
    - - California - Gives residents rights to know, delete, and opt-out of data sharing.
    - - U.S
        
        Sector-Specific data protection rules
  - - - Hides part of data for display
    - - Protects data at rest, in transit or in use.
    - - Replaces identifiers with pseudonyms
    - - Permanently removes identifiers so data cannot be traced back.
    - - Least Privilage, Role-based access, Need to know
    - - Prevents unauthorized sharing of sensitive data.
  - - - Evaluates how a new system, process, or projects will handle personal data.
      - It identifies privacy risks, like data leaks, unnecessary data collection, or non compliance with laws.
- - - - Overwriting
        
        Replace data with random bits
      - Degaussing
        
        Use magnetic fields to erase data
      - Cryptographic Erasure
        
        Delete Encryption keys
      - Physical Destruction
        
        Shredding, Incineration
      - Destruction should be documented for auditing purposes.
  - - - Legal/ regulatory requirements
      - Business Needs - Financial records for audits
      - Data Classification - Sensitive data needs stricter rules
  - - - Legal hold
      - Audit Trails
  - - - means data might not be accessible when needed — but in this case, data is too available, for too long.
    - - unnecessary retention violates the data minimization and retention limitation principles.
- - - - Security policies are applied consistently
      - Access is controlled
      - Compliance is mainatained
      - No asset becomes "Orphaned"
  - - - Data: Information and Data, Systems, Devices and Applications
        
        the Data Owner is responsible for periodically reviewing and validating user access permissions.
  - - - How Sensitive the data/system is, Which security controls (access control, encryption, monitoring) are required, Who is authorized to use it.
    - - Owners must review who has access and whether its still appropriate. This supports least privilege and need-to-know principles.
    - - Ensure: Access lists stay current, Unused or inappropriate accounts are removed, Compliance with regulations like SOX or GDPR.
- - - - Creation/ Acquisition
      - Storage/ Use
      - Sharing/Distribution
      - Archival
      - Destruction/disposal
    - - Hardware
        
        Physically secured, sanitized before disposal.
      - Software
        
        Licensed, Patched, Updated
      - Data
        
        Classified, encrypted, labeled
      - People
        
        Access based on least privilege
      - Facilities
        
        Controlled entry, surveillance
- - - - Technology based safeguards
        
        Encryption
        
        Hashing
        
        Access Controls
        
        Data Loss Prevention
        
        Back up and recovery
        
        Digital Signature
    - - Tangible protection
        
        Locks, guards, CCTV, Secured server rooms.
    - - Policies, Training, Procedures