Skip to content

Chapter 3: Domain 2: Asset Security

Abstract

The Asset Security domain focuses on controls such as data classification clearances, labels, retention, and ownership of data. Data remanence is discussed, including newly testable material such as the remanence properties of Solid State Drives (SSDs), which are a combination of EEPROM and RAM, and have quite different remanence properties compared to magnetic drives. The domain includes a discussion of controls determination, including scoping and tailoring. The domain concludes with a discussion of well-known standards, including PCI-DSS and the ISO 27000 series.

Keywords

  • Random Access Memory
  • Remanence
  • Reference monitor
  • Read Only Memory
  • Solid State Drive
  • Tailoring
  • Cloud Access Security Broker

Exam Objectives in This Chapter:

  • Classifying Data
  • Ownership and Inventory
  • Memory and Remanence
  • Data Destruction
  • Determining Data Security Controls

Unique Terms and Definitions

  • RAM—Random Access Memory, volatile hardware memory that loses integrity after loss of power.
  • Remanence—Data that persists beyond non-invasive means to delete it.
  • Reference Monitor—Mediates all access between subjects and objects.
  • ROM—Read Only Memory, non-volatile memory that maintains integrity after loss of power.
  • Scoping—The process of determining which portions of a standard will be employed by an organization.
  • SSD—Solid State Drive, a combination of flash memory (EEPROM) and DRAM.
  • Tailoring—The process of customizing a standard for an organization.

Introduction

The Asset Security (Protecting Security of Assets) domain focuses on controls such as data classification clearances, labels, retention, and ownership of data. We will discuss data remanence, including newly testable material such as the remanence properties of Solid State Drives (SSDs), which are a combination of EEPROM and RAM, and have quite different remanence properties compared to magnetic drives. The domain wraps up with a discussion of controls determination, including standards, scoping, and tailoring.