Asset Security
Core concepts
Asset security is about classifying, handling, and retaining information appropriately. Know the data classification levels (public, internal/private, confidential, restricted/secret) and that classification drives handling controls. Understand data roles: owner (accountable, sets classification), custodian (implements controls), user (follows rules). Know data states - at rest, in transit, in use - and that different controls map to each.
Lifecycle and handling
Memorize the information lifecycle: create/collect, classify, store, use/share, archive, destroy. Understand retention requirements driven by legal/regulatory needs versus business need, and that destruction must be verifiable (certificate of destruction). Know sanitization vs destruction: overwriting, degaussing, crypto-erase, physical shredding - and that SSD/flash media require different treatment than magnetic drives (degaussing does not reliably erase flash).
Traps
A classic trap is confusing data owner with custodian - the owner decides classification and access rules; the custodian executes them. Another: assuming a low classification means no controls; handling still applies. Watch for questions that conflate retention (how long kept) with destruction (how removed). Also, remember that PII/PHI carry legal handling obligations regardless of internal classification.
Worked example
A laptop with encrypted customer records is stolen. Because the data was encrypted at rest, the organization may avoid breach-notification obligations in many jurisdictions - but only if the encryption was strong and keys were not exposed. This illustrates how a control at rest changes the risk outcome, not just the classification.