cisco certification kuwait

cisco certification kuwait.Unclassified Public Unobtrusive Hazard4.5.2 Tagging assets Once an asset has been classified into a specific category, the asset itself needs to be tagged or labeled so that users accessing the asset can distinguish its category. Stamping a document with a "Top Secret" stamp and adding a watermark to a digital document with "Confidential" are examples of tagging assets.188 Chapter 4 Introduction to Access Control4.5.3 Access Control Policies Developing an access control policy for each asset or type of data is the second step in the control implementation process. In this step, it relies on the asset classification and tagging steps described in the previous section. The content of the access control policy includes what people access the asset or data at what time and in which mode. The access control policy also specifies how access should be protected, which varies depending on the state of the asset or data. An asset or data can be in any of the following states.Data at rest (data atrest): Data that resides on a storage device (for example, a hard drive, CD, or DVD). Data will be at rest for most of its life cycle. Often, strong access controls and encryption are enabled to protect data at rest.Dynamic data (datainmotion): is data that is transferred between the receiver and the sender, which means that the data is "in transit". Dynamic data is at a higher risk because it may be outside the security perimeter beyond the control of the data owner. Dynamic data is generally protected by end-to-end encryption and VPN technology.Datainuse: Data that is being processed by an application or program and is stored in temporary or volatile memory (e.g., random access memory [RAM], CPU registers, etc.).4.5.4 The data disposal access control process should include methods for disposing of assets or data when they are no longer required for use, in accordance with the provisions of the unit's data retention management system. Data disposal can take multiple steps and employ a variety of techniques. In fact, developing a sound data disposal process is as important as developing a sound in-service data protection process. "dumpster diving" is a common tactic used by malicious people who, in simple terms, disguise themselves as scavengers to go through the trash discarded by units in an attempt to find information that can be used to launch an attack (e.g., useful documents, network topology diagrams, or even passwords to access systems). Before disposing of data, it can be cleaned up by classification level. The following methods are used to clean up data. Clearing ( Clearing): This method should ensure protection against data recovery techniques that are simple and non-invasive in nature. Purging: This method should ensure protection against data recovery techniques with state-of-the-art laboratory technology.Destroying: This method should not only ensure protection against state-of-the-art laboratory techniques for data recovery, but also make the storage media unusable.4.6 Information Security Positions and Responsibilities Section 4.5 describes the various elements of the access control process and explores in detail the importance of properly classifying data and assets. So, who should decide whether to classify a particular batch of data as confidential? Who should "take the blame" (and ultimately be responsible) in the event that this data is compromised without authorization? Since data is handled by different people at different stages, it is important that the unit establish a clear plan of positions and responsibilities for this purpose. Doing so will maintain clarity of responsibility and accountability within the unit and ensure a balance between security requirements and the achievement of business objectives.