Fluent Essays

examples of personally identifiable information  and look at the importance of physical security. Understanding the nature of personally identifiable information Understand the need for physical security Explain threats to physical security NIST. (2019). Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). United States Department of Commerce. National Institute of Standards and Technology Special Publication No. 800-122. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf Chapter 5 Protecting Security of Assets Identify and Classify Assets Defining Sensitive Data Defining Classifications Determining Data Security Controls Understanding Data States Handling Information and Assets Data Protection Methods Determining Ownership Data Processors Using Security Baselines overview Defining Sensitive Data Personally Identifiable Information (PII) NIST SP 800-122 Protected Health Information (PHI) HIPAA Proprietary Data Defining Classifications 1/3 Government/Military Top Secret Secret Confidential Unclassified For Official Use Only (FOUO) Sensitive but Unclassified (SBU) Non-government Class 3, 2, 1, 0 Defining Classifications 2/3 Defining Classifications 3/3 Civilian Confidential or Proprietary Private Sensitive Public Defining Asset Classifications Asset classification should match system classifications for use/access Determining Data Security Controls Define a policy for all forms and locations of data Encrypt all the things Consider the value of data Use labels and enforcement Use data loss prevention (DLP) Set requirements for: Communications, Storage, and Backups Understanding Data States Data at rest Data in motion Data in use Encryption Authentication Authorization Handling Information and Assets 1/4 Marking Sensitive Data and Assets Physical and logical labeling Assists with DLP and human handling Address downgrading Handling Sensitive Information and Assets Be aware of common loss of control situations, such as backups and cloud storage Handling Information and Assets 2/4 Storing Sensitive Data Use storage encryption Manage the environment Provide quality storage devices for long term retention Destroying Sensitive Data NIST SP 800-88r1, “Guidelines for Media Sanitization” Handling Information and Assets 3/4 Eliminating Data Remanence HDD vs. SSD/flash Sanitization Erasing Clearing Purging Degaussing Destruction Declassification Handling Information and Assets 4/4 Ensuring Appropriate Asset Retention Record retention Media, system retention Employees and NDAs A necessary element of a security policy Data Protection Methods Protecting Data with Symmetric Encryption AES Triple DES Blowfish Protecting Data with Transport Encryption TLS VPN IPSec SSH Determining Ownership 1/4 Data Owners Asset Owners/System Owners Business/Mission Owners Data Processors (next slide) Determining Ownership 2/4 Data Processors The person or entity that controls processing of the data GDPR EU-US Privacy Shield Notice; Choice; Accountability for Onward Transfer; Security; Data Integrity and Purpose Limitation; Access; Recourse, Enforcement, and Liability Determining Ownership 3/4 Pseudonymization Artificial identifiers Anonymization Inferencing Data masking and randomization Administrators Determining Ownership 4/4 Custodians Users Protecting Privacy HIPAA California Online Privacy Protection Act of 2003 (CalOPPA) Personal Information Protection and Electronic Documents Act (Canada) GDPR NIST SP 800-53 Scoping Selecting controls that specifically apply to the protected target Tailoring Adjust security control baseline to align with organization mission Selecting Standards Contractual vs. regulation/legislation Using Security Baselines Conclusion Read the Exam Essentials Review the Chapter Perform the Written Labs Answer the Review Questions Chapter 10 Physical Security Requirements Apply Secure Principles to Site and Facility Design Secure Facility Plan Site Selection Visibility Natural Disasters Facility Design overview Secure Facility Plan Critical path analysis Security for basic requirements Technology convergence Include security staff in design considerations Site Selection Cost Location Size Security requirements Pre-existing structure or custom construction Proximity to others Weather conditions Visibility Surrounding terrain Vehicle and foot traffic Residential, business, or industrial area Line of sight Crime rate Emergency services Unique local hazards Natural Disasters Common local natural disasters Severe weather patterns Protection for workers and assets Facility Design Based on level of security needs Combustibility, fire rating Construction materials Load rating Intrusion, emergency access, resistance to entry Security architecture Crime Prevention through Environmental Design (CPTED) Implement Site and Facility Security Controls Design concepts Equipment failure Wiring closets Cable plant management policy Server rooms/data centers Media storage facilities Evidence storage Restricted and work area security Utilities and HVAC considerations Water issues Fire prevention, detection, and suppression overview Design Concepts Administrative physical security controls Technical physical security controls Physical controls for physical security Corporate vs. personal property Deterrence Denial Detection Delay Equipment Failure Failure is inevitible Purchase replacement parts as needed Onsite replacement warehousing SLA with vendors MTTF MTTR MTBF Wiring Closets Premises wire distribution room Intermediate distribution facilities (IDF) Prevent physical unauthorized access Do not use as general storage Do not store flammable materials Use video surveillance Perform regular physical inspections Cable Plant Management Policy Entrance facility Equipment room Backbone distribution system Telecommunications room Horizontal distribution system Server Rooms/Data Centers Need not be human compatible Locate in core of building One hour minimum fire rating for walls Physical access control: Smartcards, proximity readers, IDS Access abuses: Masquerade, piggyback Emanation security Faraday cages, white noise, and control zones Media Storage Facilities Store blank, reusable, and installation media Data remnants Use a locked cabinet Have a librarian or custodian Check-in/check-out process Sanitization, zeroization Evidence Storage Becoming important business task Drive images and virtual machine snapshots Distinct from production Block Internet access Track all activities Calculate hashes of all files Limit access Encrypt stored data Restricted and Work Area Security Operations centers Distinct and controlled area access Walls or partitions Shoulder surfing Assign classifications Track assets with RFID Sensitive Compartmented Information Facility (SCIF) Utilities and HVAC Considerations UPSes Double conversion UPS Line-interactive UPS Surge protectors Generators Fault, blackout, sag, brownout, spike, surge, inrush, noise, transient, clean, ground EMI vs. RFI Temperature, humidity, static Water Issues Leakage Flooding Electrocution Water detection circuits Shutoff values Drainage locations Fire Prevention, Detection, and Suppression 1/3 Fire triangle: fire, heat, oxygen, combustion Stages: Incipient, smoke, flame, heat Fire Prevention, Detection, and Suppression 2/3 Fire extinguisher classes: Class Type Suppression Material A Common combustibles Water, soda acid B Liquids CO2, halon*, soda acid C Electrical CO2, halon* D Metal Dry powder Fire Prevention, Detection, and Suppression 3/3 Fire detection systems: Fixed temperature, rate-of-rise, flame-actuated, smoke-actuated Water suppression Wet pipe, dry pipe, pre-action, deluge Gas suppression CO2, Halon, FM-200, alternatives Damage Smoke, heat, suppression media Implement and Manage Physical Security Perimeter Security Controls Internal Security Controls overview Perimeter Security Controls Fences Gates Turnstiles Mantraps Lighting Security guards and dogs Internal Security Controls 1/2 Keys and combination locks Electronic access control (EAC) locks Badges Motion detectors Infrared, heat, wave pattern, capacitance, photoelectric, passive audio Intrusion alarms Deterrent alarms, repellant alarms, notification alarms Local alarm, central station, auxiliary station Internal Security Controls 2/2 Secondary verification mechanisms Environment and life safety Privacy responsibilities and legal requirements Regulatory requirements Conclusion Read the Exam Essentials Review the Chapter Perform the Written Labs Answer the Review Questions