CISA · Domain 5
Protection of Information Assets
About 26% of the exam
Data classification
- Classify by sensitivity and criticality
- Owner classifies, custodian protects
- Labels drive handling, storage, disposal
- Prerequisite for DLP and encryption scope
- Review classification when data changes
- Retention and destruction follow the label
- Quasi-identifiers still re-identify people
You cannot protect what you have not found and labeled; classification comes before every technical control
Access control principles
- Identification
- claim an identity
- Authentication
- prove the claim
- Authorization
- what the identity may do
- Accountability
- logs tie actions to people
- Least privilege
- minimum rights for the job
- Need to know
- access only to required data
- Segregation of duties
- split incompatible functions
- Zero trust
- never trust, always verify
Authentication
- Something you know
- password, PIN
- Something you have
- token, smart card, phone
- Something you are
- fingerprint, iris, face
- Multifactor
- two different categories
- Single sign-on
- one credential, one point of failure
- Biometric FAR
- false accept, the dangerous error
- Biometric FRR
- false reject, the annoying error
- Remote access
- MFA over an encrypted channel
Access administration
- Provision from an approved request
- Periodic access reviews by the owner
- Sensitive systems reviewed quarterly or more
- Movers accumulate rights: privilege creep
- IGA automates joiner, mover, leaver
- Service accounts rotated through PAM
- Shared administrator accounts break accountability
- Leavers disabled the day they leave
Cryptography
Symmetric
- One shared key, fast, bulk data
- AES is the standard choice
- Key distribution is the weakness
- n(n-1)/2 keys for n parties
Asymmetric
- Public and private key pair
- RSA, ECC, slower, key exchange
- Encrypt with recipient public key
- Sign with sender private key
- Quantum threatens RSA and ECC
Hashing and signatures
- One way, fixed length, integrity
- SHA-2, SHA-3; MD5 and SHA-1 broken
- Digital signature: hash then encrypt with private key
- Gives integrity, authenticity, nonrepudiation
- HMAC adds a shared secret
Confidentiality from encryption, integrity from hashing, nonrepudiation from a signature with a private key only the sender holds
PKI and key management
- Certificate authority
- issues, manages, revokes certificates
- Registration authority
- verifies identity before issue
- Certificate
- binds public key to identity
- CRL and OCSP
- check revocation status
- Key escrow
- trusted copy for recovery
- Key rotation
- limit exposure, never skipped
- HSM
- hardware protects the keys
Keys stored beside the encrypted data give the attacker both; separate them
Network security controls
- Firewall
- filters traffic against rules
- IDS
- monitors and alerts only
- IPS
- blocks inline, false positives hurt
- WAF
- known web attacks, not logic flaws
- Segmentation
- flat network enables lateral movement
- Micro-segmentation
- east-west traffic controlled
- VPN
- encrypted tunnel for remote access
- Wireless
- WPA3 or WPA2, never WEP
Physical and environmental
- Mantrap with biometrics for server rooms
- Badge plus PIN, visitor escort, logs
- Cameras deter and record, do not prevent
- Fire: detection, suppression, clean agents
- Water sensors under raised floors
- UPS bridges to generator start
- HVAC and humidity within tolerance
- Media destruction with certificate
- Clean desk and locked cabinets
Endpoint, email and mobile
- Signature antivirus misses zero day and fileless
- EDR detects behavior, supports response
- SPF alone does not stop spoofing
- Add DKIM signing and DMARC policy
- Awareness plus simulated phishing changes behavior
- MDM or MAM for BYOD: encrypt, wipe
- Patch endpoints, remove local admin
- Time synchronization for usable logs
Attacks to recognize
- Phishing
- credential theft by deception
- Social engineering
- people are the weakest control
- Deepfake fraud
- callback and multi-channel verification
- Supply chain
- trusted library or build tool poisoned
- Lateral movement
- flat network, shared credentials
- Ransomware
- encrypts data, also backups
- Man in the middle
- intercepts unencrypted sessions
- Privilege escalation
- stale service accounts, misconfiguration
Data protection techniques
- DLP
- finds and blocks sensitive data leaving
- Encryption
- reversible with the key
- Tokenization
- no mathematical link, shrinks PCI scope
- Masking
- non-production copies, realistic but fake
- Anonymization
- irreversible, watch quasi-identifiers
- Pseudonymization
- reversible with a separate key
- Column encryption
- protect PII fields in databases
- Data in transit
- TLS, never plain protocols
Monitoring and forensics
- SIEM correlates events across sources
- Logs protected from the administrators they watch
- Retention longer than detection time
- No failed logins at all is suspicious
- Forensic image before any analysis
- Hash the image to prove integrity
- Chain of custody: who, what, when, where
- Work on copies, preserve the original
- Legal hold suspends normal deletion
Rapid recall
- CIA
- confidentiality, integrity, availability
- IAAA
- identify, authenticate, authorize, account
- FAR vs FRR
- wrong person in vs right person out
- IDS vs IPS
- alert vs block
- Encrypt vs tokenize
- reversible vs no relationship
- SPF, DKIM, DMARC
- sender, signature, policy
- IaaS customer
- OS, apps, identity, data, network config
- Chain of custody
- unbroken record of evidence handling
Key numbers and pairs
- Symmetric keys
- n(n-1)/2 for n users
- Asymmetric keys
- 2n for n users
- AES
- 128, 192, 256 bit keys
- Public key encrypts
- private key decrypts
- Private key signs
- public key verifies
- Access review
- quarterly or more for sensitive
- Time sync
- one source, all systems
Never trust, always verify: authenticate, authorize and re-check every request, inside the network too
Reference strip: control layers, crypto, network, data, forensics
Control layers
- Administrative: policy, training, reviews
- Technical: authentication, encryption, firewalls
- Physical: mantrap, badges, cameras, environment
- Preventive, detective, corrective at each layer
Cryptographic building blocks
- AES symmetric, RSA and ECC asymmetric
- SHA-2 and SHA-3 hashing
- Digital signature, HMAC, TLS
- PKI: CA, RA, CRL, OCSP, HSM
- Post-quantum planning for long-lived data
Network defenses
- Firewall, WAF, IDS, IPS
- Segmentation, DMZ, micro-segmentation
- VPN, zero trust access
- WPA3, 802.1X, NAC
- EDR, SIEM, east-west monitoring
Data protection toolkit
- Classification and labeling
- DLP, encryption, tokenization
- Masking, anonymization, pseudonymization
- Retention, sanitization, destruction certificates
Forensics sequence
- Identify and isolate the system
- Image and hash before analysis
- Document chain of custody
- Analyze copies, preserve originals
- Report findings, retain for legal
Quick exam traps
- Trap: A password plus a security question is multifactor authentication
- Trap: An IDS blocks the attack it detects
- Trap: Tokenized card numbers are still in PCI DSS scope
- Trap: Removing names and social security numbers makes data anonymous
- Trap: SPF records alone prevent email spoofing
- Trap: Signature antivirus protects against zero-day malware
- Trap: A WAF makes web applications fully protected
- Trap: Storing keys with the encrypted data is acceptable if the database is encrypted
cybercertprep.com · original revision sheet written from the public body of knowledge