Podcast
Questions and Answers
Which of the following is considered a human asset within an organization?
Which of the following is considered a human asset within an organization?
Intangible assets can include elements like brand and reputation.
Intangible assets can include elements like brand and reputation.
True
What does the Recovery Time Objective estimate?
What does the Recovery Time Objective estimate?
The duration an organization can operate without an asset.
_________ controls are part of the systems and services that support an organization.
_________ controls are part of the systems and services that support an organization.
Signup and view all the answers
Match the following asset classes with their examples:
Match the following asset classes with their examples:
Signup and view all the answers
What is a common concern when discussing physical assets?
What is a common concern when discussing physical assets?
Signup and view all the answers
What is the primary goal of asset identification in information security?
What is the primary goal of asset identification in information security?
Signup and view all the answers
Human assets are generally not a source of vulnerabilities for organizations.
Human assets are generally not a source of vulnerabilities for organizations.
Signup and view all the answers
Intangible assets, such as brand and reputation, are not considered key assets in information security.
Intangible assets, such as brand and reputation, are not considered key assets in information security.
Signup and view all the answers
What are the phases of the information life cycle?
What are the phases of the information life cycle?
Signup and view all the answers
What might occur if the power grid goes down?
What might occur if the power grid goes down?
Signup and view all the answers
The primary focus of asset identification includes _____, software, hardware, services, people, and intangibles.
The primary focus of asset identification includes _____, software, hardware, services, people, and intangibles.
Signup and view all the answers
Which of the following is not typically included in an asset register?
Which of the following is not typically included in an asset register?
Signup and view all the answers
Match the type of asset to its description:
Match the type of asset to its description:
Signup and view all the answers
Acquisition of information can only occur through new software purchases.
Acquisition of information can only occur through new software purchases.
Signup and view all the answers
What is a key element that may be required when acquiring information?
What is a key element that may be required when acquiring information?
Signup and view all the answers
What is the primary purpose of an asset register?
What is the primary purpose of an asset register?
Signup and view all the answers
An asset's likelihood of damage is not related to its impact on a business.
An asset's likelihood of damage is not related to its impact on a business.
Signup and view all the answers
What are the two main components that evaluate the potential effect of asset loss?
What are the two main components that evaluate the potential effect of asset loss?
Signup and view all the answers
The __________ of damage/loss for the customer credit card database is categorized as low.
The __________ of damage/loss for the customer credit card database is categorized as low.
Signup and view all the answers
Match the following asset categories with their descriptions:
Match the following asset categories with their descriptions:
Signup and view all the answers
What is a key consideration when managing archived data sets?
What is a key consideration when managing archived data sets?
Signup and view all the answers
Only authorized personnel should have access to archival data.
Only authorized personnel should have access to archival data.
Signup and view all the answers
What is one method to ensure proper destruction of physical data storage devices?
What is one method to ensure proper destruction of physical data storage devices?
Signup and view all the answers
Information that is not in use should have __________ controls applied to prevent unauthorized access.
Information that is not in use should have __________ controls applied to prevent unauthorized access.
Signup and view all the answers
Match the data management processes with their focus:
Match the data management processes with their focus:
Signup and view all the answers
Which of the following is NOT a potential challenge in data disposal?
Which of the following is NOT a potential challenge in data disposal?
Signup and view all the answers
Data must be retained indefinitely to avoid data loss.
Data must be retained indefinitely to avoid data loss.
Signup and view all the answers
Name a type of security that is important for safeguarding databases.
Name a type of security that is important for safeguarding databases.
Signup and view all the answers
Which category has the longest timeframe for response?
Which category has the longest timeframe for response?
Signup and view all the answers
An urgent task needs to be addressed within 72 hours.
An urgent task needs to be addressed within 72 hours.
Signup and view all the answers
What is the maximum allowable outage for the LAN Server?
What is the maximum allowable outage for the LAN Server?
Signup and view all the answers
The loss of __________ can lead to delayed income.
The loss of __________ can lead to delayed income.
Signup and view all the answers
Which of the following is considered a critical resource?
Which of the following is considered a critical resource?
Signup and view all the answers
Match the following processes with their corresponding resource priority:
Match the following processes with their corresponding resource priority:
Signup and view all the answers
Which of the following could result from a loss of reputation?
Which of the following could result from a loss of reputation?
Signup and view all the answers
What is one example of a violation that could arise from asset loss?
What is one example of a violation that could arise from asset loss?
Signup and view all the answers
Study Notes
Information Security Lecture 5 - Assets
- Assets are anything with value that contributes to business operations.
- Asset identification is the first stage in risk assessment.
- The goal of this initial phase is the creation of an asset register.
- The asset register lists all important assets and who is responsible for them.
Asset Identification
- Information assets include both electronically and physically stored data.
- Software assets include operating systems, applications, and development tools.
- Physical assets are those that manipulate information (e.g., computers, servers, wiring, and fiber).
- Services support the business process (e.g., heating, cooling, power, and lighting).
- People possessing the skills and knowledge to support or implement business processes are also considered assets.
- Intangible assets include brand reputation.
Asset Focus
- The diagram illustrates the different types of assets under junior and senior focus.
- Categories include intangible assets, people, systems and services, physical assets, hardware and software, information, and data.
Information Assets
- Information assets include digital assets within server databases, removable media, and traditional paper.
- Business-critical knowledge held by staff members is also an asset.
- Information can be acquired from other sources (e.g. buying datasets or taking customer details).
- Some information is created from scratch (e.g. by research and development companies).
The Information Life Cycle
- The information life cycle, in its simplest form, includes acquisition, use, archiving, and disposal.
Acquisition
- Assets may be acquired from various sources.
- Web portals or dedicated interfaces are used.
- Forms completed during business processes are also used.
- Processing is usually required to make information useful, including attaching metadata, and applying policy controls (like encryption when needed).
Use
- Prepared and stored information can be used as part of business processes.
- It is used and modified by many users.
- Defining appropriate metadata during the acquisition stage is important, as use is one of the most challenging stages for CIA (confidentiality, integrity, availability).
- Internal consistency across data stores is critical.
Archival
- What happens to information when it is not in use?
- Unauthorized access/modification can occur without appropriate controls.
- Archiving can be a basis for data backups, but it isn't the same as archiving.
- Controls need to be applied to archived data to protect it.
- Encryption is a minimum level of protection for archives.
Disposal
- Information needs to be deleted at the right time; not so soon that it is impossible to recover it in the case of an attack, but not so long that costs and compliance issues are impacted.
- Data must be properly destroyed (e.g. physical devices wiped, degaussed or shredded).
- Distributed data requires careful removal of all copies
- Dealing with third parties presents additional challenges.
Data in Use, Motion, and Rest
- Data in use is actively changed and stored in databases, warehouses, and spreadsheets (e.g, active data under constant change).
- Data in motion is data being transferred on a network, or temporarily stored in a computer's memory to be read or updated (e.g., data traversing a network).
- Data at rest resides in storage, like databases, data warehouses, spreadsheets, archives, tapes or offsite backups (e.g., inactive data stored physically).
Infrastructure
- Crucial infrastructure used during all stages.
- Understanding infrastructure helps identify threat vectors and assess risk.
- Key areas to consider include server/network security, database security, and host-based security.
Software/Service Assets
- Software/services provide access to data or tools to process data.
- Data accuracy and algorithms need careful consideration.
- Software/services are distributed throughout the network on host machines, servers and customer-facing websites.
- Denial-of-service attacks can prevent access to information.
Physical Assets
- Physical assets house software/business and provide communication channels.
- Physical damage/attacks to physical assets are significant.
- Considerations extend to network-based attacks.
Systems and Services
- Support systems like IT infrastructure, environmental controls, financial or legal support (where applicable).
- May not want to solely consider attacks (e.g., power outage).
Human Assets
- Staff and stakeholders are crucial parts of an organisation.
- They are a source of knowledge, skills and experience that is often irreplaceable.
- They can also be a primary source of vulnerabilities.
- Staff turnover can be a security issue.
Intangible Assets
- Intangible assets include brand, reputation, and broader organisational ideas.
- Their value can vary depending on the organisation.
- Attacks can target intangible assets by compromising other assets.
- The case for a comprehensive ISMS can be assisted by understanding and defining these intangible assets.
Asset Register
- List all assets and their importance/evaluation with who is accountable.
- The owner of an asset should be involved in risk analysis.
Example (Asset Register entry)
- Shows entries that would need information about the asset involved.
Estimating the Recovery Time Objective (RTO)
- Calculate how long an organisation can function without an asset.
- Asset classifications like non-essential (30 days), normal (7 days), important (72 hours), urgent (24 hours) and critical (minutes to hours) can be used.
- Critical assets need strong backups and redundancy.
Assigning value to assets
- Each asset is characterised according to its importance to a particular organisational process.
- These include loss of reputation, loss of competitive advantage, increase in operational expenses, contract violations, delayed income, loss in revenue, and loss in productivity.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Related Documents
Description
Test your knowledge on asset management in information security. This quiz covers various types of assets, their classifications, and the importance of asset identification. Understand key concepts like Recovery Time Objective and the information life cycle phases to boost your expertise.
