Computer - Media Protection

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary intent of the Media Protection policy mentioned in the text?

To restrict access to FBI Criminal Justice Information (CJI) only to authorized personnel.

To prevent the dissemination of Criminal Justice Information (CJI) within the Department.

To allow public access to Criminal Justice Information (CJI) after a certain timeframe.

To ensure the protection of Criminal Justice Information (CJI) during its entire lifecycle. (correct)

Who should be contacted in case of inadvertent or inappropriate disclosure or use of Criminal Justice Information (CJI)?

Omaha Police Department (OPD) Chief

Department’s Local Agency Security Officer (LASO) (correct)

FBI Criminal Justice Information Manager

Department of Justice Information Technology Specialist

What happens to violators of the policy according to the text?

They receive a warning.

They are immediately terminated.

They are rewarded for honesty.

They are subject to discipline, including termination and possible prosecution. (correct)

When can Criminal Justice Information (CJI) be released to the public?

When presented in crime reports data or within a court system. Signup and view all the answers

Who has the responsibility to protect and control electronic and physical Criminal Justice Information (CJI)?

Department’s Local Agency Security Officer (LASO) Signup and view all the answers

What measures should be taken regarding the transportation of CJI outside of OPD secured facilities?

It must be monitored and controlled. Signup and view all the answers

What is meant by 'At Rest' in the context of electronic/digital data?

Data that is electronically stored but not currently being accessed Signup and view all the answers

Which of the following is considered Criminal Justice Information (CJI) as per the text?

Property data Signup and view all the answers

What is the purpose of Overwriting as mentioned in the text?

To clear data from magnetic media Signup and view all the answers

What does Multi-Factor Authentication (MFA) involve?

Combining two or more authentication methods Signup and view all the answers

When is an OTP (One-Time Password) valid?

For a single login session Signup and view all the answers

What is the purpose of a Google Authenticator?

Generating six-digit codes Signup and view all the answers

What does the term 'Sanitize' mean in the context of data management?

Removing data from storage media to prevent easy retrieval Signup and view all the answers

What is the main purpose of an OTP Hardware Token?

Generating one-time passwords Signup and view all the answers

What should employees do when in possession of Criminal Justice Information (CJI) while not in a secure area?

Take precautions to obscure CJI from public view. Signup and view all the answers

How should electronic devices like laptops be secured when handling CJI?

Use session locks and privacy screens. Signup and view all the answers

What standard should the cryptographic module meet for encryption of CJI?

FIPS 140-2 standards Signup and view all the answers

How should CJI be protected on a need-to-know basis?

Limit CJI access permissions to certain employees. Signup and view all the answers

What is an example of a measure to protect electronic and physical media containing CJI during transport?

Limiting access to authorized personnel. Signup and view all the answers

How should hand-carried confidential electronic and paper documents be secured?

Accessing them electronically only. Signup and view all the answers

What is one of the methods for disposing of physical media containing CJI?

Shredding using Shred-IT issued shredders. Signup and view all the answers

Who should control, protect, and secure electronic and physical media during transport to prevent public disclosure?

Authorized personnel Signup and view all the answers

What is one of the rules for allowing access to Criminal Justice Information (CJI) to ensure security and confidentiality?

Limit access based on roles and privileges Signup and view all the answers

When should encryption be used to protect CJI when it is electronically transmitted outside a secure location?

When the data is at rest outside a secure location Signup and view all the answers

If an employee's personal electronic device with Google Authenticator installed is lost or stolen, what is the first action they should take?

Notify the DOTComm Service Desk to deactivate the device Signup and view all the answers

Which statement about DOTComm's role in the MFA system is correct?

DOTComm is the administrator of the MFA system, including OTP Hardware Tokens Signup and view all the answers

If an employee requires service for the OTP Hardware or OTP Software, what should they do?

Notify the DOTComm Service Desk Signup and view all the answers

What is the potential consequence for violating the requirements in this policy?

Loss of CJI system access privileges, civil and criminal prosecution, and/or termination Signup and view all the answers

Which of the following is NOT a relevant accreditation standard mentioned in the text?

83.3.2 Signup and view all the answers

What previous OPD Orders are relevant to this policy?

#39-20 and #36-21 Signup and view all the answers

What is the approved method for disposing of electronic media containing FBI CJI or sensitive/classified information at DOTComm?

Overwriting the media at least three times or physical destruction Signup and view all the answers

What is the first step an OPD employee must take if CJI is improperly disclosed or lost?

Notify their supervisor immediately Signup and view all the answers

Which of the following is NOT a responsibility of the CSA ISO in the event of a security incident?

Personally investigate and resolve all security incidents Signup and view all the answers

Which statement regarding the use of multi-factor authentication (MFA) for OPD devices accessing CJI is correct?

MFA is not required if the device is in a physically secure OPD location Signup and view all the answers

What are the two authentication methods required for accessing an OPD device, according to the policy?

Username/password and One-Time Password (OTP) token Signup and view all the answers

If an OPD employee's OTP hardware token is lost or stolen, what should they do first?

Notify the DOTComm Service Desk to deactivate the token Signup and view all the answers

What is the purpose of the CLEIN-NCIC Security Incident Report Form that must be completed within 24 hours of a CJI incident?

To report the incident to the FBI CJIS Division ISO Signup and view all the answers

Which of the following statements regarding the use of an email authentication method for OPD devices is correct?

Email authentication can only be used if the user does not have access to their OTP token Signup and view all the answers

According to the policy, which of the following actions should be taken if an OTP hardware token is damaged?

Obtain a replacement token from the Police Supply Unit Signup and view all the answers

What is the purpose of the requirement for OPD devices to use multi-factor authentication when accessing CJI?

To ensure the integrity and confidentiality of CJI data Signup and view all the answers

Study Notes

Media Protection Policy Intent

Primary intent is to safeguard Criminal Justice Information (CJI) from unauthorized access and disclosure.

Contact for Inadvertent Disclosure

In case of inadvertent or inappropriate disclosure of CJI, contact the designated security officer immediately.

Violators of the Policy

Violators may face disciplinary action, which can include termination or legal consequences.

Release of CJI to the Public

CJI can only be released to the public under specific legal statutes or regulations.

Responsibility for CJI Protection

Responsibility for protecting and controlling CJI lies with all employees handling this information.

Transportation of CJI

Transportation of CJI outside OPD secured facilities requires additional protective measures, including secure packaging and controlled access.

'At Rest' Definition

'At Rest' refers to data that is stored in a physical or electronic form and is not actively being transmitted or processed.

Examples of CJI

Criminal Justice Information (CJI) includes sensitive data related to criminal investigations, arrests, court proceedings, and individuals.

Purpose of Overwriting

Overwriting serves to permanently erase data, making it unrecoverable, and protects against unauthorized access.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication involves verification of identity using two or more factors, such as passwords and security tokens.

OTP Validity

One-Time Passwords (OTPs) are valid for a limited timeframe, typically 30 to 60 seconds, to enhance security during authentication.

Google Authenticator Purpose

Google Authenticator provides an additional layer of security by generating time-sensitive OTPs for MFA.

Data Management - 'Sanitize'

'Sanitize' refers to the process of removing sensitive information from data storage to prevent unauthorized retrieval.

OTP Hardware Token Purpose

Main purpose is to act as a physical device for generating secure OTPs, providing an additional verification method.

Handling CJI Outside Secure Areas

Employees must ensure CJI is not left unattended and must take measures to secure any devices or documents containing this information.

Securing Laptops with CJI

Laptops should be secured through encryption, password protection, and locking screens when not in use.

Cryptographic Module Standards

Cryptographic modules for encrypting CJI must meet government or industry standards for security compliance.

Need-to-Know Basis Protection

CJI access should be strictly limited to individuals who require it for their job responsibilities.

Transport Measures for CJI

Electronic and physical media containing CJI should be secured in tamper-proof containers and monitored during transport.

Securing Hand-Carried Documents

Confidential documents carried by hand must be kept in locked cases and attended at all times.

Disposal Methods for CJI Media

One method for disposing of physical media is shredding to ensure complete destruction of sensitive information.

Media Control During Transport

Designated individuals must control and secure media during transport to prevent unauthorized public disclosure.

Access Rules for CJI

Access to CJI must be granted based on job necessity, with regular audits to ensure compliance.

When to Use Encryption

Encryption is required when transmitting CJI electronically outside of secure facilities.

First Action for Lost Personal Devices

If an employee’s personal device containing Google Authenticator is lost or stolen, they should immediately report the loss and disable access.

DOTComm and MFA System

DOTComm plays a role in managing and maintaining the integrity and functionality of the MFA system.

OTP Hardware/Software Service Requests

Employees requiring service for OTP hardware or software must follow the designated support protocols.

Consequences of Policy Violations

Potential consequences for policy violations can include reprimands, loss of access privileges, or legal ramifications.

Non-Relevant Accreditation Standards

Standards not mentioned in the context of the policy are deemed irrelevant to compliance measures.

Previous OPD Orders

Previous orders related to the policy include documentation outlining past security protocols and trainings.

Approved Disposal Method for Sensitive Information

The approved method for disposing of electronic media containing FBI CJI involves certified destruction processes.

Initial Response to Improper CJI Disclosure

The first step for an OPD employee in case of improper disclosure of CJI is to notify their supervisor and document the incident.

CSA ISO Responsibilities

Certain responsibilities, such as incident management, may not fall within the CSA ISO’s purview during a security incident.

MFA for OPD Devices

Use of multi-factor authentication for accessing OPD devices is mandatory to enhance security when handling CJI.

Required Authentication Methods

Two authentication methods are required: a password and an OTP generated through an approved device or application.

Response to Lost OTP Hardware Token

If an OTP hardware token is lost, the first action should be to report it and request a replacement immediately.

CLEIN-NCIC Security Incident Report Form Purpose

This form documents CJI incidents within 24 hours, ensuring that proper records are maintained for accountability.

Email Authentication Method Rule

There are specified rules for email authentication to ensure that access to CJI via email is secure and monitored.

Actions for Damaged OTP Hardware Token

If an OTP hardware token is damaged, the employee must report it to IT or designated personnel for evaluation and replacement.

Purpose of MFA Requirement for OPD Devices

The MFA requirement aims to provide layered security against unauthorized access to sensitive CJI, minimizing risk.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Test your knowledge on the Media Protection policy that ensures the safeguarding of Criminal Justice Information (CJI) until its authorized release or destruction in accordance with record retention rules. Explore the scope of this policy for electronic and physical media containing FBI Criminal Justice Information.