Asset Security

Identification and Classification

• Inventory: You must identify and list all assets (hardware, software, data) to protect them.

• Valuation: Assets are valued to determine the appropriate level of security. This can be quantitative (e.g., monetary cost) or qualitative (e.g., labels like High/Medium/Low).

• Classification: Data is grouped by sensitivity (e.g., Confidential, Public) to enforce access controls.

• Categorisation: Determines the impact if data is lost or damaged (Confidentiality, Integrity, Availability).

2. Roles and Responsibilities

• Data Owner: Has ultimate accountability for the data. They decide the classification and who gets access.

• Data Custodian: Responsible for the technical protection of data (e.g., performing backups, patching systems).

• Data Controller: Determines why and how personal data is processed.

• Data Processor: Processes data on behalf of the controller (e.g., a cloud provider).

3. Asset Lifecycle Data must be protected during all phases:

1. Create: Classify data immediately upon creation.

2. Store: Protect data at rest using encryption and access controls.

3. Use: Data is most vulnerable here because it must be unencrypted to be processed.

4. Share: Use encryption (like TLS) to protect data in transit between users or systems.

5. Archive: Long-term storage governed by retention policies.

6. Destroy: Securely removing data when no longer needed.

4. Data States

• Data at Rest: Data stored on media (hard drives, tapes) and protected by encryption and physical security.

• Data in Transit (Motion): Data moving across a network. Protected by link encryption or end-to-end encryption.

• Data in Use: Data currently in memory or being processed. It is generally unencrypted and vulnerable.

5. Privacy and Retention

• Privacy: Organisations must protect Personally Identifiable Information (PII). The OECD guidelines provide principles for handling personal data, such as limiting collection and specifying the purpose.

• Retention: Data should be kept only as long as required by laws or business needs.

6. Data Destruction

• Data Remanence: Data left behind after an attempt to delete it.

• Clearing: Removing data so standard user tools cannot recover it.

• Purging: Removing data so it cannot be recovered by laboratory techniques (e.g., degaussing agents).

• Destruction: Physically destroying the media (shredding, melting).

• SSD Sanitisation: Standard overwriting is ineffective on Solid State Drives (SSDs). Cryptographic erasure (destroying the encryption keys) is the preferred method.

7. Security Baselines

• Baselines: Minimum security standards applied to all systems.

• Scoping: Removing baseline controls that do not apply to a specific system.

• Tailoring: Modifying baseline controls to fit the specific organization's needs.