CISSP Flashcards: Asset Security, Data Classification, Handling, Retention

The four US government classification levels from highest to lowest sensitivity are top secret, secret, confidential, and unclassified. Top secret information could cause exceptionally grave damage to national security if disclosed. Secret information could cause serious damage. Confidential information could cause damage. Unclassified information requires no protection from disclosure. Private sector organizations typically use different labels such as confidential, private, sensitive, and public.

The data owner is typically a senior manager who has ultimate responsibility for the data, sets classification levels, defines access policies, and ensures compliance with regulations. The data custodian is typically an IT professional who implements and maintains the technical controls that protect the data, including backups, access controls, and encryption. The data steward ensures data quality, accuracy, and appropriate use within business processes.

Data remanence is the residual representation of data that remains on storage media after deletion or formatting attempts. Simply deleting a file or formatting a drive does not destroy the data because only the reference pointer is removed. Methods to address remanence include overwriting which writes patterns over existing data, degaussing which destroys magnetic fields on magnetic media using a strong electromagnet, and physical destruction through shredding, incineration, or pulverizing. For highly classified data, degaussing or physical destruction is required.

Data at rest is stored data residing on hard drives, databases, backups, or removable media, protected primarily by encryption, access controls, and physical security. Data in transit is data moving across networks, protected by transport encryption protocols like TLS, VPNs, and IPsec. Data in use is data being actively processed in memory or CPU registers, which is the most difficult state to protect because it must be decrypted for processing. Emerging technologies like homomorphic encryption and secure enclaves address data-in-use protection.

Data loss prevention, or DLP, is a set of technologies and policies that detect and prevent unauthorized transmission of sensitive data outside the organization. DLP solutions monitor three channels: network DLP inspects data in transit across email, web, and file transfers; endpoint DLP monitors data on workstations including USB transfers, printing, and clipboard operations; and storage DLP scans data at rest in file servers and databases. DLP identifies sensitive data through content inspection using patterns, keywords, and data fingerprinting.

A data retention policy defines how long different types of data must be kept and when they must be destroyed. Retention periods are driven by legal and regulatory requirements, business needs, and contractual obligations. Keeping data longer than necessary increases storage costs, breach exposure, and legal discovery obligations. Destroying data too soon can violate retention regulations and destroy evidence needed for litigation. The policy must address all data formats including electronic files, emails, backups, and paper records.

The General Data Protection Regulation, or GDPR, is the European Union privacy law that applies to any organization processing personal data of EU residents regardless of where the organization is located. Key requirements include lawful basis for processing, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality. It grants individuals rights including access, erasure also called the right to be forgotten, portability, and objection. ---