CYS401 · Chapter 4 · Annotated SlidesProtection of Information Assets
Original
Overview

Protection of Information Assets

Information assets, security governance vs. management, third parties and ASPs, due care vs. due diligence, classification (government and commercial) and its criteria, marking and handling, data at rest/in transit/in use, retention and destruction (erasing, clearing, purging, destruction), privacy laws (GDPR, CCPA, PDPL), ownership roles, and strategic/tactical/operational plans. Majors A, B and C each had a due-care question and a destruction or classification question from here.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 71 slides
  1. 1 Protection of Information Assets
  2. 2 Learning Objectives
  3. 3 What Is an Information Asset?
  4. 4 Main Categories of Information Assets
  5. 5 Slide 5
  6. 6 INFORMATION ASSET SECURITY
  7. 7 Security Governance and Information Assets
  8. 8 SECURITY GOVERNANCE PRINCIPLES
  9. 9 Management :
  10. 10 Cybersecurity Governance
  11. 11 Cybersecurity Governance
  12. 12 Cybersecurity Management
  13. 13 Slide 13
  14. 14 EVALUATE AND APPLY SECURITY GOVERNANCE PRINCIPLES
  15. 15 Security is not and should not be treated as an IT issue only.
  16. 16 ASP: An Application Service Provider (ASP) is a company that delivers software applications over the internet. Instead of hosting the software on your own servers, the ASP hosts and maintains it on their servers.
  17. 17 Due Care vs. Due Diligence
  18. 18 Due Care vs. Due Diligence
  19. 19 Information Classification
  20. 20 Classification Systems
  21. 21 Top Secret
  22. 22 Commercial classification systems
  23. 23 Classification Criteria
  24. 24 Commercial classification systems
  25. 25 EXAMPES OF RESTRICTED DATA
  26. 26 Class Exercise
  27. 27 DEFINING ASSET CLASSIFICATIONS
  28. 28 SECURITY REQUIREMENTS FOR DIFFERENT DATA CLASSES
  29. 29 Marking Sensitive Data and Assets
  30. 30 Slide 30
  31. 31 HANDLING INFORMATION AND ASSETS
  32. 32 Protecting Data at Rest
  33. 33 Protecting Data in Transit
  34. 34 Protecting Data in Use
  35. 35 Record and Asset Retention
  36. 36 Secure Data Destruction
  37. 37 Destroying Sensitive Data
  38. 38 Common terms associated with Digital Data Disposal:
  39. 39 DEGAUSSER MACHINES
  40. 40 DESTROYING DATA MACHINES
  41. 41 Slide 41
  42. 42 Legal Compliance as a Governance Driver
  43. 43 European Union – General Data Protection Regulation (GDPR)
  44. 44 United States – Sectoral & State-Based
  45. 45 Saudi Arabia - Personal Data Protection Law (PDPL)
  46. 46 ASSET OWNERSHIP
  47. 47 ASSET OWNERSHIP
  48. 48 ASSET OWNERSHIP
  49. 49 Example:
  50. 50 Information Owner
  51. 51 DETERMINING OWNERSHIP
  52. 52 DATA OWNER
  53. 53 ASSET OWNERS
  54. 54 Best Practices for Information Asset Protection
  55. 55 ALIGNMENT OF SECURITY FUNCTION
  56. 56 BUSINESS/MISSION OWNERS
  57. 57 ALIGNMENT OF SECURITY FUNCTION
  58. 58 Top-Down Approach
  59. 59 THE INFORMATION SECURITY (INFOSEC) TEAM
  60. 60 DEVELOPING AND IMPLEMENTING A SECURITY POLICY
  61. 61 DEVELOPING AND IMPLEMENTING A SECURITY POLICY
  62. 62 STRATEGIC SECURITY PLAN
  63. 63 TACTICAL SECURITY PLAN
  64. 64 OPERATIONAL SECURITY PLAN
  65. 65 Planning Levels vs Asset Protection
  66. 66 Example
  67. 67 Ex. Strategic Security Plan (Long-Term WHY ) – “ ”
  68. 68 Ex. Tactical Security Plan (Mid-Term – “WHAT ”)
  69. 69 Operational Security Plan (Short-Term – “HOW”)
  70. 70 How the Plans Work Together (Big Picture)
  71. 71 Slide 71
Slide 1 / 71

Protection of Information Assets

Slide 1: Protection of Information Assets

Notes

  1. Tip Due care = DOING the right thing (the protective action: training, patching, responding to a breach). Due diligence = RESEARCHING and checking (risk assessments, investigating threats, auditing vendors before access).

Slide 2 / 71

Learning Objectives

Slide 2: Learning Objectives

Notes

  1. Assets → governance → due care/diligence → classification → handling → destruction → laws → ownership → planning.

Slide 3 / 71

What Is an Information Asset?

Slide 3: What Is an Information Asset?
Slide 4 / 71

Main Categories of Information Assets

Slide 4: Main Categories of Information Assets

Notes

  1. Primary assets (the information and business processes) vs. supporting assets (hardware, software, networks, people, sites).

Slide 5 / 71

Slide 5

Slide 5: Slide 5

Notes

  1. Protect assets because information drives operations and decisions, and loss means financial, legal and reputational damage.

Slide 6 / 71

INFORMATION ASSET SECURITY

Slide 6: INFORMATION ASSET SECURITY
Slide 7 / 71

Security Governance and Information Assets

Slide 7: Security Governance and Information Assets

Notes

  1. Security governance defines how assets are protected: accountability, alignment with business, compliance, risk-based decisions.

Slide 8 / 71

SECURITY GOVERNANCE PRINCIPLES

Slide 8: SECURITY GOVERNANCE PRINCIPLES
Slide 9 / 71

Management :

Slide 9: Management :

Notes

  1. Governance = “doing the right things” (direction, oversight). Management = “doing things right” (tactical, operational execution).

  2. Memory trick Governance decides WHAT and WHY; management does HOW.

Exam angle

PredictionQ1

Which describes cybersecurity MANAGEMENT rather than governance?

Slide 10 / 71

Cybersecurity Governance

Slide 10: Cybersecurity Governance
Slide 11 / 71

Cybersecurity Governance

Slide 11: Cybersecurity Governance
Slide 12 / 71

Cybersecurity Management

Slide 12: Cybersecurity Management
Slide 13 / 71

Slide 13

Slide 13: Slide 13
Slide 14 / 71

EVALUATE AND APPLY SECURITY GOVERNANCE PRINCIPLES

Slide 14: EVALUATE AND APPLY SECURITY GOVERNANCE PRINCIPLES

Notes

  1. Global organizations face conflicting laws across countries; governance gives direction and oversight.

Slide 15 / 71

Security is not and should not be treated as an IT issue only.

Slide 15: Security is not and should not be treated as an IT issue only.
Slide 16 / 71

ASP: An Application Service Provider (ASP) is a company that delivers software applications over the internet. Instead of hosting the software on your own servers, the ASP hosts and maintains it on their servers.

Slide 16: ASP: An Application Service Provider (ASP) is a company that delivers software applications over the internet. Instead of hosting the software on your own servers, the ASP hosts and maintains it on their servers.

Notes

  1. ASP (Application Service Provider): delivers applications over the internet from its own servers. The organization stays accountable for its data → review the provider’s security and set an SLA with security requirements, responsibilities and breach notification.

Exam angle

Past exam · Major C

B · what is an ASP and what to do to protect data

PredictionQ1

What is an ASP, and what should be done to protect data when using one? (Major C)

Compare with the model answer

An Application Service Provider hosts and maintains software on its own servers and delivers it to customers over the internet. The organization remains accountable for its data, so it must review the provider’s security (due diligence) before engaging, and sign an SLA covering security requirements, responsibilities and breach notification, then audit the provider’s controls.

Slide 17 / 71

Due Care vs. Due Diligence

Slide 17: Due Care vs. Due Diligence

Notes

  1. Due care: the reasonable steps taken to protect assets (enforce passwords, patch, train). Due diligence: the research and assessment that finds what is needed (risk assessments, audits).

  2. Tip Due care = DOING the right thing (the protective action: training, patching, responding to a breach). Due diligence = RESEARCHING and checking (risk assessments, investigating threats, auditing vendors before access).

Exam angle

Past exam · Major A

D · due care or due diligence

Past exam · Major B

E · due care or due diligence

Past exam · Major C

E · due care, diligence or both

Past exam · Major AQ1

A company runs workshops on security practices to comply with NCA standards. This is:

Past exam · Major BQ2

A company conducts risk assessments every two months to identify threats. This is:

Past exam · Major CQ3

A company requires vendors to sign a data protection agreement and pass security audits before access. This is:

PredictionQ4

Ransomware encrypts a company’s files. It had not updated its antivirus for a year and ignored its vendors’ security advice. Which failures does this show? (Major C)

Compare with the model answer

Both: not updating the antivirus is a failure of due care (the protective action), and ignoring the vendors’ security examination advice is a failure of due diligence (the investigation).

Slide 18 / 71

Due Care vs. Due Diligence

Slide 18: Due Care vs. Due Diligence
Slide 19 / 71

Information Classification

Slide 19: Information Classification
Slide 20 / 71

Classification Systems

Slide 20: Classification Systems

Exam angle

Past exam · Final 221 · B

Related question: match · top secret + engineering label = MAC

PredictionQ1

Which is NOT a government classification level?

Slide 21 / 71

Top Secret

Slide 21: Top Secret

Exam angle

PredictionQ1

Unauthorized disclosure that could cause “exceptionally grave damage” to national security defines:

Slide 22 / 71

Commercial classification systems

Slide 22: Commercial classification systems
Slide 23 / 71

Classification Criteria

Slide 23: Classification Criteria

Notes

  1. Criteria: business value, legal/regulatory impact, sensitivity, impact if disclosed/altered/lost, age/useful life.

  2. Trap Strategic/tactical/operational are kinds of PLANS, not classification criteria.

Exam angle

Past exam · Major C

C · three commercial classification criteria

PredictionQ1

Give three criteria used to classify information in commercial systems. (Major C)

Compare with the model answer

Business value; legal and regulatory requirements; damage or impact if the information is disclosed, altered or lost (also age/useful life and personal association).

Slide 24 / 71

Commercial classification systems

Slide 24: Commercial classification systems
Slide 25 / 71

EXAMPES OF RESTRICTED DATA

Slide 25: EXAMPES OF RESTRICTED DATA
Slide 26 / 71

Class Exercise

Slide 26: Class Exercise
Slide 27 / 71

DEFINING ASSET CLASSIFICATIONS

Slide 27: DEFINING ASSET CLASSIFICATIONS
Slide 28 / 71

SECURITY REQUIREMENTS FOR DIFFERENT DATA CLASSES

Slide 28: SECURITY REQUIREMENTS FOR DIFFERENT DATA CLASSES
Slide 29 / 71

Marking Sensitive Data and Assets

Slide 29: Marking Sensitive Data and Assets
Slide 30 / 71

Slide 30

Slide 30: Slide 30

Notes

  1. Examples of labels.

Slide 31 / 71

HANDLING INFORMATION AND ASSETS

Slide 31: HANDLING INFORMATION AND ASSETS
Slide 32 / 71

Protecting Data at Rest

Slide 32: Protecting Data at Rest
Slide 33 / 71

Protecting Data in Transit

Slide 33: Protecting Data in Transit
Slide 34 / 71

Protecting Data in Use

Slide 34: Protecting Data in Use

Notes

  1. Seen again Ch 1, slide 19: Information states

Slide 35 / 71

Record and Asset Retention

Slide 35: Record and Asset Retention
Slide 36 / 71

Secure Data Destruction

Slide 36: Secure Data Destruction
Slide 37 / 71

Destroying Sensitive Data

Slide 37: Destroying Sensitive Data
Slide 38 / 71

Common terms associated with Digital Data Disposal:

Slide 38: Common terms associated with Digital Data Disposal:

Notes

  1. Erasing = delete (recoverable). Formatting = new file structure (mostly recoverable). Clearing/overwriting = beats normal recovery tools (media can be reused). Purging = stronger (degaussing, crypto-erase). Destruction = most secure.

  2. Tip Weakest → strongest: erasing (delete, recoverable) · formatting · clearing/overwriting (beats normal recovery tools) · purging (degaussing, crypto-erase) · destruction (shred, incinerate, disintegrate, pulverize).

Exam angle

Past exam · Major C

A · clearing, erasing, most secure method

Past exam · Major A

written · ways to sanitize media

Past exam · Major CQ1

Overwriting media so traditional recovery tools can’t recover the data, allowing reuse, is:

Past exam · Major CQ2

Simply performing a delete operation against files is:

Past exam · Major CQ3

The most secure method of sanitizing media is:

Slide 39 / 71

DEGAUSSER MACHINES

Slide 39: DEGAUSSER MACHINES

Notes

  1. A degausser realigns magnetic fields on HDDs and tapes. It does NOT work on SSDs.

Exam angle

PredictionQ1

Degaussing reliably removes data from SSDs.

Slide 40 / 71

DESTROYING DATA MACHINES

Slide 40: DESTROYING DATA MACHINES

Notes

  1. Destruction machines (shredders, disintegrators).

Slide 41 / 71

Slide 41

Slide 41: Slide 41

Notes

  1. Legal compliance figure.

Slide 42 / 71

Legal Compliance as a Governance Driver

Slide 42: Legal Compliance as a Governance Driver
Slide 43 / 71

European Union – General Data Protection Regulation (GDPR)

Slide 43: European Union – General Data Protection Regulation (GDPR)

Exam angle

PredictionQ1

The GDPR applies to:

Slide 44 / 71

United States – Sectoral & State-Based

Slide 44: United States – Sectoral & State-Based
Slide 45 / 71

Saudi Arabia - Personal Data Protection Law (PDPL)

Slide 45: Saudi Arabia - Personal Data Protection Law (PDPL)

Exam angle

PredictionQ1

Saudi Arabia’s comprehensive personal data law is the:

Slide 46 / 71

ASSET OWNERSHIP

Slide 46: ASSET OWNERSHIP
Slide 47 / 71

ASSET OWNERSHIP

Slide 47: ASSET OWNERSHIP
Slide 48 / 71

ASSET OWNERSHIP

Slide 48: ASSET OWNERSHIP
Slide 49 / 71

Example:

Slide 49: Example:
Slide 50 / 71

Information Owner

Slide 50: Information Owner

Notes

  1. Library example: director = owner, IT = custodian, staff = users.

Slide 51 / 71

DETERMINING OWNERSHIP

Slide 51: DETERMINING OWNERSHIP
Slide 52 / 71

DATA OWNER

Slide 52: DATA OWNER

Notes

  1. Trap The data OWNER decides access; the CUSTODIAN only implements it.

Exam angle

Past exam · Major A

A · who decides access and privileges (data owner)

Past exam · Major AQ1

According to NIST SP 800-18, who decides who has access to an information system and with what privileges?

Slide 53 / 71

ASSET OWNERS

Slide 53: ASSET OWNERS
Slide 54 / 71

Best Practices for Information Asset Protection

Slide 54: Best Practices for Information Asset Protection
Slide 55 / 71

ALIGNMENT OF SECURITY FUNCTION

Slide 55: ALIGNMENT OF SECURITY FUNCTION
Slide 56 / 71

BUSINESS/MISSION OWNERS

Slide 56: BUSINESS/MISSION OWNERS
Slide 57 / 71

ALIGNMENT OF SECURITY FUNCTION

Slide 57: ALIGNMENT OF SECURITY FUNCTION
Slide 58 / 71

Top-Down Approach

Slide 58: Top-Down Approach

Exam angle

PredictionQ1

In the top-down approach, security policy is initiated by:

Slide 59 / 71

THE INFORMATION SECURITY (INFOSEC) TEAM

Slide 59: THE INFORMATION SECURITY (INFOSEC) TEAM
Slide 60 / 71

DEVELOPING AND IMPLEMENTING A SECURITY POLICY

Slide 60: DEVELOPING AND IMPLEMENTING A SECURITY POLICY

Notes

  1. Three plans: strategic, tactical, operational.

Slide 61 / 71

DEVELOPING AND IMPLEMENTING A SECURITY POLICY

Slide 61: DEVELOPING AND IMPLEMENTING A SECURITY POLICY
Slide 62 / 71

STRATEGIC SECURITY PLAN

Slide 62: STRATEGIC SECURITY PLAN

Exam angle

Past exam · Major A

B · T/F strategic plan is short-term and detailed (false)

Past exam · Major AQ1

A strategic plan is a short-term plan with many details.

Slide 63 / 71

TACTICAL SECURITY PLAN

Slide 63: TACTICAL SECURITY PLAN
Slide 64 / 71

OPERATIONAL SECURITY PLAN

Slide 64: OPERATIONAL SECURITY PLAN

Exam angle

PredictionQ1

Which plan is short-term, highly detailed and updated often?

Slide 65 / 71

Planning Levels vs Asset Protection

Slide 65: Planning Levels vs Asset Protection
Slide 66 / 71

Example

Slide 66: Example
Slide 67 / 71

Ex. Strategic Security Plan (Long-Term WHY ) – “ ”

Slide 67: Ex. Strategic Security Plan (Long-Term WHY ) – “ ”
Slide 68 / 71

Ex. Tactical Security Plan (Mid-Term – “WHAT ”)

Slide 68: Ex. Tactical Security Plan (Mid-Term – “WHAT ”)
Slide 69 / 71

Operational Security Plan (Short-Term – “HOW”)

Slide 69: Operational Security Plan (Short-Term – “HOW”)
Slide 70 / 71

How the Plans Work Together (Big Picture)

Slide 70: How the Plans Work Together (Big Picture)

Notes

  1. WHY → WHAT → HOW.

  2. Memory trick Strategic = WHY, Tactical = WHAT, Operational = HOW.

Slide 71 / 71

Slide 71

Slide 71: Slide 71

Notes

  1. End of chapter.