Chapter 5: Protecting Security of Assets. Classifying and Labeling Assets Defining sensitive data Defining classifications Defining data security requirements.

Slides:

Advertisements

Similar presentations

Chapter 10 Encryption: A Matter of Trust. Awad –Electronic Commerce 1/e © 2002 Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic Algorithm.

Advertisements

IT Security Policy Framework

1 SANS Technology Institute - Candidate for Master of Science Degree 1 Automating Crosswalk between SP 800, 20 Critical Controls, and Australian Government.

Lecture 8 Access Control (cont)

1 Computer Networks: A Systems Approach, 5e Larry L. Peterson and Bruce S. Davie Chapter 8 Network Security Copyright © 2010, Elsevier Inc. All rights.

A dialogue with FMUG: Sensitive Data & Filemaker MIT Policy and Data Classifications ** DRAFT ** Guidelines Feedback and Discussion Tim McGovern 2 June.

Personal Data Protection and Security Measures Justin Law IT Services - Information Security Team 25 & 27 November 2013.

Confidentiality and Privacy Controls

Lesson 12 Cryptography for E-Commerce. Approaches to Network Security Separate Security Protocol--SSL Application-Specific Security--SHTTP Security with.

Chapter 9: Using and Managing Keys Security+ Guide to Network Security Fundamentals Second Edition.

Principles of Information Security, 2nd edition1 Cryptography.

Personal Data Protection and Security Measures Justin Law IT Services - Information Security Team 18, 20 & 25 March 2015.

Wireless Encryption By: Kara Dolansky Network Management Spring 2009.

Agenda Scope of Requirement Security Requirements

Chapter 9 Information Systems Controls for System Reliability— Part 2: Confidentiality and Privacy Copyright © 2012 Pearson Education, Inc. publishing.

TCP/IP Protocol Suite 1 Chapter 28 Upon completion you will be able to: Security Differentiate between two categories of cryptography schemes Understand.

Copyright © 2015 Pearson Education, Inc. Confidentiality and Privacy Controls Chapter

Key Management Guidelines. 1. Introduction 2. Glossary of Terms and Acronyms 3. Cryptographic Algorithms, Keys and Other Keying Material 4. Key Management.

Chapter 11: Dial-Up Connectivity in Remote Access Designs

Digital Certificates Public Key Deception Digital Certificates Certificate Authorities Public Key Infrastructures (PKIs)

Obtaining, Storing and Using Confidential Data October 2, 2014 Georgia Department of Audits and Accounts.

Lecture 12 Electronic Business (MGT-485). Recap – Lecture 11 E-Commerce Security Environment Security Threats in E-commerce Technology Solutions.

Lecture 30 Information Security (Cont’d). Overview Organizational Structures Roles and Responsibilities Information Classification Risk Management 2.

Information Security Technological Security Implementation and Privacy Protection.

1 Chapter 8: Security in Electronic Commerce IT357 Electronic Commerce.

Chapter 14 Encryption: A Matter Of Trust. Awad –Electronic Commerce 2/e © 2004 Pearson Prentice Hall 2 OBJECTIVES What is Encryption? Basic Cryptographic.

Thomas Levy. Agenda 1.Aims: CIAN 2.Common Business Attacks 3.Information Security & Risk Management 4.Access Control 5.Cryptography 6.Physical Security.

Privacy and Encryption in eGovernment Dewey Landrum Technical Architect – CSO SLED West Sector CISSP August 11, 2008.

32.1 Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction.

Applied Technology Services, Inc. Your Partner in Technology Applied Technology Services, Inc. Your Partner in Technology.

SSL / TLS in ITDS Arun Vishwanathan 23 rd Dec 2003.

Group 2: Marco Hidalgo Wesley Lao Michelle Marquez-Lim

WSV323. CSO/CIO department Regulation translated to control objectives Infrastructure Support Control objectives turned into control activities.

1 Secure Commonwealth Panel Health and Medical Subpanel Debbie Condrey - Chief Information Officer Virginia Department of Health December 16, 2013 Virginia.

1 Copyright © 2014 M. E. Kabay. All rights reserved. CSH5 Chapter 67 “Developing Classification Policies for Data” Karthik Raman & Kevin Beets Classification.

Lecture Materials for the John Wiley & Sons book: Cyber Security: Managing Networks, Conducting Tests, and Investigating Intrusions October 7, 2015 DRAFT1.

©2010 Check Point Software Technologies Ltd. | [Unrestricted] For everyone Network Access Technology: Secure Remote Access S Prasanna Bhaskaran.

Information Security Governance and Risk Chapter 2 Part 3 Pages 100 to 141.

Digital Envelopes, Secure Socket Layer and Digital Certificates By: Anthony and James.

LeToia Crozier, Esq., CHC Vice President, Compliance & Regulatory Affairs Corey Wilson Director of Technical Services & Security Officer Interactive Think.

Information Security Training for People who Supervise Computer Users.

Chapter 11 Privacy and Secrets. Chapter Outline Privacy and Regulation What to do about passwords Random Number generation Cryptography Secrets in Memory.

Symmetric Cryptography, Asymmetric Cryptography, and Digital Signatures.

Virtual Private Network Benefits Classification Tunneling technique, PPTP, L2TP, IPSec Encryption Technology Key Management Technology Authentication Settings.

IT Security Policy Framework ● Policies ● Standards ● Procedures ● Guidelines.

Sensitive But Unclassified (SBU) Information

Csci5233 Computer Security & Integrity 1 Overview of Security & Java (based on GS: Ch. 1)

ISO/IEC 27001:2013 Annex A.8 Asset management

Staying ahead of the storm: know your role in information security before a crisis hits Jason Testart, IST Karen Jack, Secretariat.

Chapter 14 Network Encryption

Privilege Management Chapter 22.

CSI-09 COMMUNICATION TECHNOLOGY SECURITY MECHANISMS IN A NETWORK AUTHOR - V. V. SUBRAHMANYAM.

Chapter 1: Security Governance Through Principles and Policies

Information Security. Your responsibilities as a Government of Canada employee.

This courseware is copyrighted © 2016 gtslearning. No part of this courseware or any training material supplied by gtslearning International Limited to.

UNIT 7 SEMINAR Unit 7 Chapter 9, plus Lab 13 Course Name – IT482 Network Design Instructor – David Roberts – Office Hours: Tuesday.

Security Protecting information data confidentiality

Domain 2 – Asset Security

Developing a Data Risk Classification Program

Azure Information Protection

Confidentiality and Privacy Controls

Azure Information Protection

Chapter 6 Cryptography CISSP Study Guide BIS 4113/6113.

CompTIA Security+ Study Guide (SY0-401)

TEL382 Greene Chapter 5.

Security Policies and Implementation Issues

Presentation transcript:

Chapter 5: Protecting Security of Assets

Classifying and Labeling Assets Defining sensitive data Defining classifications Defining data security requirements Understanding data states Managing sensitive data Protecting confidentiality with cryptography

Defining Sensitive Data Personally identifiable information (PII) NIST SP Protected health information (PHI) HIPAA Proprietary data Credit Card Mobile Payments (MCX or Apple-Pay)

Defining Classifications 1/2 Government/military Top secret Secret Confidential Unclassified Nongovernment Classes 3, 2, 1, 0

Defining Classifications 2/2 Civilian Confidential or proprietary Private Sensitive Public

Defining Data Security Requirements Encrypt everything Consider the value of data Use labels and enforcement Use data loss prevention (DLP) Set requirements for Communications Storage Backups

Understanding Data States Data at rest Data in motion Data in use Encryption Authentication Authorization

Managing Sensitive Data Marking sensitive data Handling sensitive data Storing sensitive data Destroying sensitive data Erasing, clearing, purging, declassification Sanitization, degaussing, destruction Retaining assets

Protecting Confidentiality with Cryptography Protecting data with symmetric encryption AES Triple DES Blowfish Protecting data with transport encryption TLS VPN IPSec SSH

Identifying Data Roles Data owners System owners Business/mission owners Data processors Administrators Custodians Users

Protecting Privacy Using security baselines – NIST SP Scoping and tailoring Selecting standards