Domain 5: Protection of Information Assets

In a block of flats, the owners' committee decides how secure the building should be and pays for it. The caretaker fits the locks. Each resident decides who gets a key to their own flat. Everyone is expected to shut the main door behind them.

Information security works the same way. Security governance is the board and senior management setting direction, managing risk and providing resources. It's part of corporate governance.

At home, you don't lock the TV guide in a safe, but you probably keep your passport somewhere secure. Protecting everything to the highest level would be expensive and exhausting; protecting nothing would be reckless.

Data classification sorts information by how much harm it could do, so protection is proportionate.

Names alone are harmless. Names plus dates of birth plus home addresses are an identity thief's dream. Combining data can raise its sensitivity.

Unlabelled data should default to a protective level such as internal, not to public.

1. 1Objectives and scope of information security.
2. 2Management's commitment.
3. 3Roles and responsibilities.
4. 4Principles: risk-based, classification, least privilege, segregation of duties.
5. 5Compliance monitoring, exceptions, consequences.
6. 6Owner and review frequency.

Do policies exist for key areas, approved at the right level? Are they current, communicated and acknowledged? Consistent with standards? Above all: are they actually followed? Test compliance, don't just read the document.

1. 1Inventory of personal data and records of processing?
2. 2Lawful basis and privacy notice for each purpose?
3. 3DPIAs done before high-risk processing?
4. 4Data subject requests answered on time?
5. 5Retention periods defined and enforced?
6. 6Processor contracts, breach process and transfer mechanisms in place?

1. 1Match HR leaver lists to active accounts: any orphans?
2. 2Sample new and changed accounts for approval.
3. 3Check access reviews were done by owners, and excess removed.
4. 4Find shared, generic and default accounts.
5. 5Review privileged and service accounts.
6. 6Check MFA on SSO and federation.

1. 1Remote access: VPN, remote desktop, webmail.
2. 2Privileged and administrator accounts.
3. 3Cloud administration consoles.
4. 4Sensitive data and payment systems.

Unlocking your phone with your face or thumb is biometrics. At set-up, the phone records your features as a template (enrolment). Each time you unlock it, it compares a fresh scan with the template and lets you in if they're close enough.

'Close enough' is the tricky bit. No two scans are ever identical, so the system has to decide how strict to be.

1. 1Build roles from job functions; business owners approve their content.
2. 2Check each role for internal SoD conflicts before use.
3. 3Assign users to roles, never directly to permissions.
4. 4Review roles and memberships regularly.
5. 5Avoid role explosion: hundreds of narrow roles become unmanageable.

1. 1Automatic logoff or screen lock after inactivity.
2. 2Limits on concurrent sessions.
3. 3Restrictions by time, location or device for sensitive functions.
4. 4Show the last login time, so users can spot misuse.

1. 1MFA for all remote access.
2. 2Vendor access switched on only when needed, monitored, then switched off.
3. 3Never expose remote desktop directly to the internet.
4. 4Service accounts: owned, non-interactive where possible, minimal rights, rotated credentials.

A combination padlock is public: anyone can see how it works. What keeps your locker safe is the combination. Cryptography works the same way. The algorithm (the lock design) is public; the key (the combination) must stay secret.

And just like a padlock, it's only as good as how carefully you guard the combination.

How do two people agree a secret key without anyone overhearing? Posting it, emailing it or phoning it all risk interception. This is symmetric encryption's main weakness.

The answer in practice: use asymmetric cryptography to exchange or wrap a symmetric session key, as TLS does.

1. 1Full-disk and file encryption.
2. 2Database and backup encryption.
3. 3VPN and TLS traffic, after the key exchange.
4. 4Wi-Fi encryption (WPA2, WPA3).

With ordinary (symmetric) encryption, both people use the same secret key. That works, but it raises an awkward question: how do you get the key to the other person safely in the first place? Send it by email and anyone reading the email has it.

Asymmetric encryption removes that problem. There's nothing secret to send.

Everyone gets a matching pair of keys. They're mathematically linked: whatever one key locks, only the other key of the same pair can unlock.

Asymmetric encryption is slow, often hundreds of times slower than symmetric encryption. Encrypting a large file or a video call with it would be painfully slow.

So real systems mix the two. This is called hybrid encryption, and it's how HTTPS works every time you open a website.

1. 1 Make a session key A random symmetric key for this conversation.
2. 2 Lock the session key With the receiver's public key (slow, but it's tiny).
3. 3 Send the data Encrypted with the fast session key.
4. 4 Receiver unlocks Private key opens the session key, which opens the data.

In the past, a letter was sealed with wax pressed by the sender's personal ring. Only the ring's owner could make that mark, and a broken seal showed tampering.

A digital signature does both jobs electronically. Only the holder of the private key can make it, and any change to the message breaks it.

Verification only means something if the public key really belongs to the claimed sender. A digital certificate from a trusted certificate authority provides that link.

Non-repudiation also needs the private key under its owner's sole control: on a smart card, token or HSM, protected by a PIN. A shared or stolen key breaks it. A timestamp proves when something was signed.

1. 1Signed contracts and documents.
2. 2Signed email (S/MIME).
3. 3Code signing, so software can be checked before installing.
4. 4Banking and EDI transactions.
5. 5Certificates themselves, signed by the CA.

A passport links your photo and name, and a government you trust vouches for it. Border staff check it's genuine, in date and not reported stolen.

A digital certificate does the same for a public key. A public key infrastructure (PKI) is the system of trusted issuers, identity checks and revocation lists that makes it work.

1. 1CPS and certificate policy exist and are followed.
2. 2Strong identity checks by the RA.
3. 3CA keys in HSMs with dual control; root CA offline.
4. 4Timely revocation; CRLs published, OCSP available.
5. 5Certificate inventory and expiry monitoring.
6. 6Escrow encryption keys if needed, never signing keys.

1. 1Behind the external firewall, to see what gets through.
2. 2In front of critical segments: data centre, payment zone.
3. 3On critical hosts (HIDS), and with cloud-native tools.
4. 4Honeypot: a decoy with no real use, so any touch is suspicious.
5. 5Honeynet: a network of honeypots, isolated from real systems.

Imagine driving through a busy city in a sealed, armoured lorry. Everyone can see the lorry, but nobody can see or touch what's inside.

A virtual private network (VPN) does that for data crossing the internet. Site-to-site VPNs join offices or data centres; remote-access VPNs connect individual users.

DLP tools look for sensitive content in use (on devices), in motion (email, web) and at rest (file shares, cloud), and alert or block when a rule is broken.

They rely on data classification to know what counts as sensitive.

Servers hate the same things your phone does: being dropped in water, overheating, and power cuts in the middle of something important.

Environmental controls protect computer rooms from power problems, fire, water and heat, and they only work if they're tested.

Online, writeable backups reachable with the same admin credentials get encrypted along with everything else. Keep offline or immutable copies with separate credentials.

Think of a postal service. An attacker can block the post office door so nothing gets through (availability). They can forge the return address (identity). Or they can steam open letters, read them and even change them (confidentiality and integrity).

Network attacks fall into the same three groups, and each has a matching control.

1. 1Ingress filtering: block incoming packets claiming internal addresses.
2. 2Egress filtering: stop internal hosts sending forged source addresses.
3. 3ARP spoofing on a LAN: dynamic ARP inspection, port security.
4. 4Port scans often come first: firewall logs and IDS can spot them.
5. 5Fewer exposed services means less for attackers to find.

The attacker plants a script in a page that other users then view: in a comment (stored XSS), in a link (reflected XSS), or by tweaking the page in the browser (DOM-based XSS). The script runs with the site's trust and can steal session cookies.

Key fix: output encoding, so data is displayed as text, never run as code. Also input validation, a content security policy and HttpOnly cookies.

1. 1Plan and agree the rules of engagement.
2. 2Reconnaissance, scanning and enumeration.
3. 3Exploitation.
4. 4Post-exploitation: privilege escalation, lateral movement.
5. 5Report with prioritised recommendations.
6. 6Management fixes; testers retest. Testers don't fix things themselves.

1. 1Mean time to detect, contain and recover.
2. 2Incidents by type, and repeats.
3. 3Lessons-learned review: root cause, report to management.
4. 4Update controls and the plan; skip this and it happens again.

A forensic image is a bit-by-bit copy, made through a write blocker so the original can't change. Hashes of the original and the copy must match, proving they're identical.

All analysis is done on the copy. Switching on a seized device, or opening its files, changes the evidence.

1. 1Recognise when forensics is needed.
2. 2Don't damage the evidence.
3. 3Bring in qualified specialists and legal counsel early.
4. 4Collection must be lawful and respect privacy and employee rights.
5. 5Follow documented procedures (e.g. ISO/IEC 27037) and validated tools.
6. 6Cloud and mobile evidence add challenges: location, provider cooperation, encryption.

Road safety isn't just about seatbelts and airbags. It's also about drivers who check their mirrors and slow down near schools. Good habits, practised often, prevent most accidents.

Many security incidents start with a person: clicking a phishing link, reusing a password, emailing the wrong file, holding a door for a stranger. Awareness training builds the habits that stop them.

Make reporting easy (a 'report phishing' button, a hotline) and thank people who report, even when they clicked first.

If staff fear punishment for a mistake, they hide it, and the security team loses precious time.

Logs nobody reviews aren't a detective control. Review should be risk-based: automated alerts for high-risk events, regular independent review of privileged activity, and periodic trend reviews. SOAR tools automate parts of the response; a SOC watches around the clock.