CISSP
Domain 2 · 10%
Asset Security
The smallest domain by weight but the one that decides what a "1" and a "0" of the CIA triad actually apply to: classifying data, assigning who is accountable for it, and controlling it through its full lifecycle — including how it's destroyed.
Classification
Government/military model (ascending sensitivity): Unclassified → Confidential → Secret → Top Secret. Commercial model: Public → Internal → Confidential → Restricted (naming varies by org). Classification drives handling requirements — storage, transmission, marking, destruction — and should be reassessed periodically, since data can be declassified or reclassified over time.
Data roles
- Owner — ultimate accountability, sets classification (usually a business executive, not IT).
- Custodian — implements the technical controls the owner requires (backups, access controls) — typically IT/security staff.
- Steward — manages data quality and context, common in data governance programs.
- Controller vs. Processor (GDPR terms) — the controller decides why/how data is processed; the processor acts on the controller's instructions.
- User/subject — consumes the data under the access rules the owner set.
Data states and protection
- At rest — stored (disk, backup). Protected primarily by encryption and access control.
- In transit — moving across a network. Protected by transport encryption (TLS, IPsec).
- In use — loaded in memory/being processed. Hardest to protect; addressed by techniques like memory encryption, secure enclaves, and homomorphic encryption at the research/emerging end.
Complementary controls: DLP (Data Loss Prevention, detects/blocks exfiltration by content inspection), DRM (Digital/Information Rights Management, controls use after distribution), tokenization (replaces sensitive data with a non-sensitive surrogate) and masking (obscures data for non-production use, e.g. test environments).
Data lifecycle
Create → Store → Use → Share → Archive → Destroy. Retention policy should be driven by legal/regulatory requirement and business need, not "keep everything forever" — over-retention is itself a liability (bigger breach blast radius, more to produce in discovery).
Data remanence and sanitization
NIST SP 800-88 defines three levels, increasing in assurance:
- Clear — logical technique (e.g. overwrite) protecting against simple, non-invasive recovery. Media is reusable.
- Purge — physical or logical technique (e.g. cryptographic erase, degaussing) rendering data recovery infeasible even with state-of-the-art lab techniques. Media may still be reusable.
- Destroy — physical destruction (shredding, incineration, disintegration). Media is not reusable. Required for the highest classification levels or when media can't be reliably purged (e.g. some flash media).
Deletion alone (moving to a "recycle bin" or removing a file pointer) leaves the underlying data recoverable — this is data remanence, and it's the trap answer on exam questions that ask "how do I dispose of this drive."
Baselines and scoping/tailoring
A baseline is the minimum set of controls for a given classification/system type (e.g. NIST 800-53 control baselines). Scoping removes controls that don't apply to a given environment; tailoring adjusts a control (adding, removing, or modifying parameters) to fit the specific context — both are how a generic baseline becomes an actionable, organization-specific standard.