CISSP Asset Security Domain | CISSP Domain 2: Asset Security | CISSP Training | Simplilearn

2. What’s in it for you? • What is CISSP? • Why Asset Security? • What is Asset Security? • Asset Security domains

3. What is CISSP?

4. Click here to watch the video

5. What is CISSP? Certified Information Systems Security Professional (CISSP) certification is an advanced level cyber security certification, it trains a candidate to become an information assurance professional. This is one of the toughest cyber security certifications.

6. What is CISSP? The CISSP Certification has a total of 8 domains:

7. What is CISSP? The CISSP Certification has a total of 8 domains: Security and Risk Management • Asset Security Security Engineering Security Operations • Communications and Network Security Security Assessment and Testing • Software • Development Security • Identity and Access Management

8. What is CISSP? The CISSP Certification has a total of 8 domains: Security and Risk Management Now, we will learn more about the second domain that is Asset Security • Asset Security Security Engineering Security Operations • Communications and Network Security Security Assessment and Testing • Software • Development Security • Identity and Access Management

9. Why Asset Security? It was yet another normal day in Tim’s organization

10. Why Asset Security? Until, a hacker decided to attack the servers in his organization

11. Why Asset Security? The hacker could access only some of the information which had less protection

12. Why Asset Security? However, this had a huge impact on the organization. Later it was discovered that there was a flaw in the information classification process which left even sensitive data with very less security

13. Why Asset Security? However, this had a huge impact on the organization. Later it was discovered that there was a flaw in the information classification process which left even sensitive data with very less security This gave rise to Asset Security

14. What is Asset Security? Asset Security deals with the collection and protection of assets such as data, and devices

15. What is Asset Security? Asset Security comprises of the following domains: 1. Information Classification • 2. Data Classification 3. Data Lifecycle 5. Data Loss Prevention • 4. Data Remanence

16. What is Asset Security? Asset Security comprises of the following domains: Let’s have a look at each of these domains under Asset Security 1. Information Classification • 2. Data Classification 3. Data Lifecycle 5. Data Loss Prevention • 4. Data Remanence

17. Information Classification

18. 1. Information Classification Not all data has the same value to an organization. Some data is more crucial compared to the rest. Hence it is important to classify all the available data

19. 1. Information Classification Information Classification is the process of segregating data based on its importance to provide adequate level of protection to every piece of data

20. 1. Information Classification Information Classification varies from sector to sector based on their objectives:

21. 1. Information Classification Information Classification varies from sector to sector based on their objectives: Here, it is used to minimize risks on crucial information General

22. 1. Information Classification Information Classification varies from sector to sector based on their objectives: General Government/ Military sector Here, it is used to prevent unauthorized access

23. 1. Information Classification Information Classification varies from sector to sector based on their objectives: General Commercial sector Government/ Military sector Here it is used to keep sensitive information private

24. Data Classification

25. 2. Data Classification Few of the considerations taken while classifying data are as follows:

26. 2. Data Classification Few of the considerations taken while classifying data are as follows: Data retention requirements • Compliance requirements Data encryption requirements • Data security requirements Data disposal methods

27. 2. Data Classification The data owner is responsible for data classification and takes care of the following:

28. 2. Data Classification The data owner is responsible for data classification and takes care of the following: Analyzes the use and value of the available data to the company

29. 2. Data Classification The data owner is responsible for data classification and takes care of the following: The data owner also annually reviews the data classification

30. 2. Data Classification The data owner is responsible for data classification and takes care of the following: Let us now have a look at the data lifecycle and start from the data creation step The data owner also annually reviews the data classification

31. Data Lifecycle

32. 3. Data Lifecycle Destroy Share Use Archive Create Store

33. 3. Data Lifecycle Destroy Share Use Archive Create Store In the create phase, new data is generated, or the existing data is updated

34. 3. Data Lifecycle Destroy Share Use Archive Create Store After creation of data, data repositories are used to store this data

35. 3. Data Lifecycle Destroy Share Use Archive Create Store In this phase, data is viewed, processed, or used in some application

36. 3. Data Lifecycle Destroy Share Use Archive Create Store Data is then shared between users and customers

37. 3. Data Lifecycle Destroy Share Use Archive Create Store Inactive data is identified and moved into long term storage systems

38. 3. Data Lifecycle Destroy Share Use Archive Create Store Data is destroyed either digitally or physically. This should be done based on regulations

39. 3. Data Lifecycle Destroy Share Use Archive Create But what happens if the data is not destroyed even after we try to erase it? Store Data is destroyed either digitally or physically. This should be done based on regulations

40. 3. Data Lifecycle Destroy Share Use Archive Create This gives rise to data remanence Store Data is destroyed either digitally or physically. This should be done based on regulations

41. Data Remanence

42. 4. Data Remanence Data Remanence is called the residual of digital data which remains even after attempting to erase that data

43. 4. Data Remanence Security professionals should be well versed with techniques to avoid Data Remanence

44. 4. Data Remanence Shown below are the methods used to tackle data remanence 4. Degaussing 1. Purging 5. Storing 2. Clearing 6. Destruction 3. Overwriting

45. 4. Data Remanence Shown below are the methods used to tackle data remanence 4. Degaussing 1. Purging Purging is used to minimize risks on crucial information 5. Storing 2. Clearing 6. Destruction 3. Overwriting

46. 4. Data Remanence Shown below are the methods used to tackle data remanence 4. Degaussing 1. Purging Data is removed from the storage device, but it can be reconstructed by using special software 5. Storing 2. Clearing 6. Destruction 3. Overwriting

47. 4. Data Remanence Shown below are the methods used to tackle data remanence 4. Degaussing 1. Purging 5. Storing 2. Clearing 6. Destruction 3. Overwriting It involves overwriting data several times so that the original data cannot be recovered

48. 4. Data Remanence Shown below are the methods used to tackle data remanence 4. Degaussing 1. Purging 5. Storing 2. Clearing 6. Destruction 3. Overwriting This method is used to destroy data on magnetic storage tapes

49. 4. Data Remanence Shown below are the methods used to tackle data remanence 4. Degaussing 1. Purging 5. Storing 2. Clearing 6. Destruction 3. Overwriting Here, data is stored on media. Prior to the storage, the data is encrypted for safety

50. 4. Data Remanence Shown below are the methods used to tackle data remanence 4. Degaussing 1. Purging 5. Storing 2. Clearing 6. Destruction 3. Overwriting Data in the storage device is physically damaged to make recovery difficult