Asset Security
The Asset Security domain tests how information and supporting assets are classified, owned, handled, retained, and destroyed. Questions focus on data roles, lifecycle controls, privacy obligations, and media sanitization rather than network defense.
Core rules and concepts
- Classification tiers commonly run public, internal, confidential, restricted; the scheme must map to handling rules for storage, transmission, labeling, and disposal.
- The data owner is accountable for classification and access decisions; the data custodian implements controls such as backups and encryption; the data steward maintains quality and metadata; users follow handling rules.
- The lifecycle covers creation, storage, use, sharing, archiving, and destruction. Retention schedules are driven by legal, regulatory, and business needs, not storage capacity.
- Sanitization terms matter: clearing resists simple recovery, purging resists laboratory recovery, and destruction makes recovery infeasible. Data remanence is residual data after deletion.
- DLP, DRM, and labeling enforce handling; privacy controls limit collection and use.
Worked example
A dataset contains names, national IDs, and payment card numbers. It is classified restricted because re-identification and financial harm are plausible. The business owner approves access; the custodian encrypts it at rest and in transit, restricts keys, and logs access. Retention is seven years for tax evidence; after that, records are purged by cryptographic erase or physical destruction according to media type, with a certificate of destruction. Sharing with a vendor requires a contract, minimum necessary fields, and transfer safeguards.
Traps
Treating the custodian as the decision-maker; confusing retention with backup duration; assuming file deletion sanitizes media; and applying one destruction method to HDDs, SSDs, and paper without checking effectiveness.