CISSP - Domain 2

40 flashcards · Computer Science · by Jaysen Lewis

1. Describe the Information Lifecycle?

   Data Acquisition - The information is either created, purchased or copied from another location. Make it useful, index it, and store it. Data Use - How do we ensure the data is kept confidential, the integrity is intact, and it is available when needed (The CIA triad). Data Archival - Retention is required by law, or the data will be used later. Know Archival (for use/ required) vs. Backup (for restore). Data Disposal - How do we dispose properly of the data once it is no longer useful/ require…

2. Study the Data Classification Policies:

   Unclassified isn't really a classification *

3. What are the 3 States of Data?

   Data At Rest How do we protect it? We use hardware or software encryption, disk encryption (full/partial), USB encryption, tape encryption (avoid CDs/DVDs). Data In Motion/ In Transit How do we protect it? We encrypt our network traffic, end-to-end encryption, secure protocols (https) this is both on internal and external networks. Data In Use How do we protect it? We use good practices, policies, user training: clean desk policy, view-angle protectors, print policy, no ‘shoulder surfing’, lock…

4. What is the difference between L1 and L2 Cache memory?

   L1 cache is on the CPU (fastest). L2 cache is connected to the CPU, but is outside it. Think - PS controller. L2 button is on the outside. L1 is

5. What is a volatile type of memory?

   RAM (including DRAM, SRAM, SDRAM). It loses the memory content after a power loss (or within a few minutes). Think - "I'll just have a dRAM." Once it's gone, it's gone :( . Anything that ends with the letters "ram" is volatile.

6. What is SRAM?

   Static RAM Fast and expensive. Uses latches to store bits (Flip-Flops). Does not need refreshing to keep data, keeps data until power is lost. This can be embedded on the CPU.

7. What is DRAM?

   Dynamic RAM Slow and cheap. Uses small capacitors Must be refreshed to keep data integrity (100-1000ms) Can be embedded on hardware that needs dedicated memory, like graphics cards

8. What is SDRAM?

   Synchronous DRAM What we normally see in the memory slots on our motherboard DDR (Double Data Rate) DDR1,2,3,4 SDRAM Easy to install/ remove

9. What is ROM?

   Read-Only Memory Non-volatile Written Permanently or Semi-permanently to the computer's physical memory chip. Most commonly used for BIOS or Firmware Retains memory after power loss Contents cannot be changed by Apps or the OS Can be erased and overwritten to perform upgrades.

10. What is PROM, EPROM and EEPROM?

    PROM (Programmable read only memory) EPROM (Erasable programmable read only memory) EEPROM (Electrically erasable programmable read only memory)

11. What is PLD?

    PLD - (Programmable logic devices) are programmable after they leave the factory (EPROM, EEPROM and flash memory). Not PROM.

12. What is an example of Flash memory?

    USB sticks, small portable drives

13. What type of memory is an SSD drive?

    Combo of EEPROM and DRAM Cannot be degaussed

14. What is firmware?

    The low-level OS and config stored on an embedded device. The BIOS on a computer, router or switch

15. What type of memory are common firmware chips?

    PROM, EPROM and EEPROM

16. What type of memory are USB sticks/ small portable drives?

    EEPROM

17. How do you get rid of the data on an SSD drive?

    ATA Secure Erase (if the drive is functional) Destruction/ Shredding Cannot be degaussed.

18. What happens when you delete a file?

    Deleting a file just removes it from the table; everything is still recoverable.

19. How is overwriting (clearing) data handled?

    By writing 0s or random characters over the data.

20. What happens when you format data on a drive?

    Almost the same as deleting but it puts a new file structure over the old one. Still recoverable in most cases.

21. Describe data Sanitization.

    A combination of processes that ensure that data from a system cannot be recovered by any means. Good method for

22. What is Degaussing?

    Destroys magnetic media (tapes, drives) by exposing it to a very strong magnetic field. This will also most likely destroy the media integrity.

23. What are examples of physical destruction of data?

    Disk crushers Metal/ Drive Shredders (usually provided as a service) Incineration, pulverizing, melting and acid have been used.

24. What does a CASB do?

    Cloud Access Security Broker On-prem or cloud software b/w users & cloud apps that monitors user activity, warns admins about possible malicious/dangerous actions, malware prevention, protects against shadow IT, and enforces security policy compliance.

25. In data protection, what is DLP?

    Data Loss Prevention Detecting & preventing data breaches, data exfiltration & unwanted destruction of sensitive data. 2 Types: Network DLP & ENdpoint DLP.

26. What type of DLP do we use for Data In Motion/ In Transit?

    Network DLP

27. What type of DLP do we use for Data At Rest & Data In Use?

    Endpoint DLP

28. What is Data Remanence?

    Data left over after normal removal and deletion of data. "Erasing" and "Clearing" data can result in remnant data.

29. Know the different roles of mission, data and system owners, security admins, supervisors, data custodians, users and auditors.

30. What are some of the frameworks we can use for Data Security Control?

    PCI-DSS ISO27000 OCTAVE COBIT ITIL

31. True or False: SSD Drives can be Degaussed

    False.

32. If we want to erase EPROM memory (perhaps to update to the latest firmware), how would we achieve that?

    Shine a UV light on the chip. EPROM memory can be "flashed" this way.

33. Which type of ROM can only be programmed once?

    PROM (Programmable Read Only Memory)

34. When coming up with a data retention policy, what should we base the decision on?

    It should be based on this concept: Data should not be kept beyond the period of usefulness or beyond the legal requirements (which is greater).

35. When designating sensitivity labels to our data, what should be considered?

    How impactful disclosure would be Who will access it Value of the data

36. True or False: Data retention policies address how to destroy data after retention has expired.

    False. A data destruction policy would address how to destroy data no longer needed/ required. Retention policies should only address how we deal with how we RETAIN data - (what, how long and where data should be stored).

37. Describe the e-discovery process.

    e-Discovery or Discovery of electronically stored information (ESI) is the process of producing all relevant documentation and data to a court or external attorneys in a legal proceeding.

38. What is responsible for memory assignment & memory protection?

    The OS (Operating System).

39. Where is the BIOS stored?

    in Firmware (ROM).

40. Alex works for the U.S. federal government and is required to ensure that the devices and components he acquires are not compromised. What program will he participate in to help ensure this?

    Trusted Foundry The U.S. Trusted Foundry program helps to protect the supply chain for components and devices by ensuring that the companies that produce and supply them are secure