Asset Security
This chapter is from the book
This chapter is from the book
This chapter is from the book
This chapter covers the following topics:
Asset Security Concepts: Concepts discussed include asset and data policies, data quality, and data documentation and organization.
Identify and Classify Information and Assets: Classification topics discussed include data and asset classification, sensitivity and criticality, private sector classifications, and military and government classifications.
Information and Asset Handling Requirements: Topics include marking, labeling, storing, and destruction.
Provision Resources Securely: Topics include how to determine and document information, asset ownership, asset inventory, and asset management.
Data Life Cycle: Components include the data life cycle, databases, data audit, data roles, data collection, data location, data maintenance, data retention, data remanence, collection limitation, and data destruction.
Asset Retention: Retention concepts discussed include media, hardware, and personnel retention and asset retention terms.
Data Security Controls: Topics include data security, data states, data access and sharing, data storage and archiving, baselines, scoping and tailoring, standards selections, and data protection methods.
Assets are any entities that are valuable to an organization and include tangible and intangible assets. As mentioned in Chapter 1, “Security and Risk Management,” tangible assets include computers, facilities, supplies, and personnel. Intangible assets include intellectual property, data, and organizational reputation. All assets in an organization must be protected to ensure the organization’s future success. Although securing some assets is as easy as locking them in a safe, other assets require more advanced security measures. The most valuable asset of any organization is its data.
The Asset Security domain addresses a broad array of topics, including information and asset identification and classification, information and asset handling, information and asset ownership, asset inventory and asset management, data life cycle, asset retention, and data security controls and compliance requirements. Out of 100 percent of the exam, this domain carries an average weight of 10 percent, which is the lowest weight of the domains.
A security professional must be concerned with all aspects of asset security. The most important factor in determining the controls used to ensure asset security is an asset’s value. Although some assets in the organization may be considered more important because they have greater value, you should ensure that no assets are forgotten. This chapter covers all the aspects of asset security that you, as an IT security professional, must understand.