Protection of Information Assets
What this domain tests
Domain 5 is the largest area: preserving confidentiality, integrity and availability of information across its lifecycle - classification, access control, authentication, cryptography, network and physical security, and incident response.
Classification and access control
Data classification drives handling rules, retention and access approval. Access models: discretionary (owner's discretion, flexible, weakest central control), mandatory (labels and clearances, as in military systems), role-based (rights attached to job roles - low administrative overhead, suited to stable structures), and attribute-based (policy evaluated from multiple attributes). Enforce least privilege and need-to-know, and recertify access periodically and on transfer or termination.
Identity and cryptography
Authentication factors are something you know, have, or are; multifactor means different factor types. Biometrics are judged by FAR (impostor accepted), FRR (legitimate user rejected) and the crossover error rate where the two meet - a lower CER means a more accurate device. Symmetric algorithms such as AES are fast but suffer key distribution; asymmetric algorithms such as RSA solve key exchange and enable signatures but are slow, so hybrid schemes encrypt a symmetric session key with the recipient's public key. A digital signature is the sender's private key applied to a message hash and gives integrity, authenticity and non-repudiation - not confidentiality. PKI binds identity to a public key via a CA certificate, with CRL/OCSP for revocation. Passwords are salted and hashed, never reversibly encrypted.
Network and physical
Firewalls filter by rule; IDS detects and alerts; IPS blocks inline; a DMZ hosts public-facing services; TLS protects data in transit; segmentation limits lateral movement. Physical controls layer perimeter, mantraps, CCTV and environmental protection.
Worked example
The sender hashes the message, encrypts the hash with the sender's private key, and transmits message plus signature. The receiver decrypts the signature with the sender's public key from a trusted certificate, rehashes the message and compares. Matching hashes plus a valid certificate chain prove integrity, origin and non-repudiation. If confidentiality is also required, the message body must additionally be encrypted with the receiver's public key.
Traps
Claiming a digital signature provides confidentiality; confusing hashing with encryption; assuming a firewall stops insiders; mixing up IDS and IPS roles.