Asset Security

Asset Security

Information Life Cycle

1.     Acquisition
2.     Use
3.     Archival
4.     Disposal

    
Information Classification
Classification Levels - Commercial Business - highest to lowest

1.     Confidential
2.     Private
3.     Sensitive
4.     Public

    
Classification Levels - Militarty purpose - highest to lowest

1.     Top Secret
2.     Secret
3.     Confidential
4.     Sensitive but unclassified
5.     Unclassified

    
Classification Controls
Layers of Responsibility

1.     Executive Management
2.     CEO
3.     CFO
4.     CIO
5.     CPO
6.     CSO/CISO
7.     Data Owner
8.     Data Custodian
9.     System Owner
10.     Security Administrator
11.     Supervisor
12.     Change Control Analyst
13.     Data Analyst
14.     User
15.     Auditor

    
Retention Policies

How ?

1.     Taxonomy
2.     Classification
3.     Normalization
4.     Indexing

    
How Long ?

1.     Business Documents - 7 years
2.     Invoices - 5 years
3.     Accounts payable and receivable - 7 years
4.     Human Resource Files - 7 years (Hired and Leave) or 3 years (candidates not hired)
5.     Tax records - 4 years after the taxes are paid
6.     Legal correspondence - Permanently

    
What Data ?
    e-Discovery

1.         Identification
2.         Preservation
3.         Collection
4.         Processing
5.         Review
6.         Analysis
7.         Production
8.         Presentation

    
Protecting Privacy
Data Owners    
Data Processers    
Data Remanence

1.         Overwriting
2.         Degaussing
3.         Encryption
4.         Physical Destruction

    Limits on Collection
    
Protecting Assets
    Data Security Controls

1.         Data at Rest
2.         Data in Motion
3.         Data in Use

    Media Controls

1.         Tracking
2.         Effectively implementing access controls
3.         Tracking the number and location of backup versions
4.         Documenting the history of changes on media
5.         Ensuring environmental conditions do not endanger media
6.         Ensuring media integrity
7.         Inventoring the media on a scheduled basis
8.         Carrying out secure disposal activities
9.         Internal and external labeling

        
Data Leakage
Date Leak Prevention
    General Approaches to DLP

1.         Data Inventories
2.         Data Flows

    
    Data Protection Strategy

1.         Backup and recovery
2.         Data life cycle
3.         Physical Security
4.         Security Culture
5.         Privacy   
6.         Organizational change

        
    Implementation, Testing, and Tuning 

1.         Sensitive data awareness
2.         Policy Engine
3.         Interoperability
4.         Accuracy

    
    DLP Resiliency
        

1.     Network DLP
2.     Endpoint DLP
3.     Hybrid DLP

Protecting Other Assets

1.     Protecting Mobile Devices
2.     Paper Records
3.     Safes