- Welcome to Lesson 15, Deep Dive Quiz.
And in Lesson 15 it's all about
explaining the security implications of proper hardware,
software, and data asset management.
And we had two lessons, 15.1, Asset Management,
where we also talked about inventory management,
and end of life,
and 15.2, where we talked about deletion,
disposal, and destruction,
as well as archiving and retention.
So, you ready to do a five question quiz?
Make sure you have a pen or pencil and a pad of paper.
Put me on pause as often as you need to,
so that you can take your time and answer the questions.
I really want this to be an interactive experience.
Ready?
All right, let's start.
"Historically, the IT group at the nonprofit you work at
has made the asset classification decisions
and there's been little oversight.
You want to modify this process to be in accordance
with generally accepted best practices.
Which group would you recommend be responsible
for asset classification decisions and control oversight?
Administrators, executives,
asset owners, or asset custodians?"
What do you think?
Put me on pause if you need to,
if you wanna read the question again.
So what group are we gonna recommend to be responsible
for asset classification decisions and control oversight?
Well, I'm gonna choose the asset owner,
because classification decisions and control oversight
really belong to that asset owner,
with the caveat that if we're in a mandatory environment
where we have, you know it's military, or national security,
or even government, where we have classification officers
who do that job, but in the environments in industry
that most of us work in, it would be the asset owner.
What about the other answers?
Well, asset custodian isn't making the decisions, right?
And isn't doing the oversight.
The asset custodian is doing the managing,
the monitoring, the implementation,
maybe advising on those decisions and educating.
And if we go up, well using an administrator
as an asset custodian?
Now an executive could be an asset owner,
but an executive doesn't have to be an asset owner.
So asset owner is the one I like.
You agree?
All right, let's see.
And that is correct.
Question 2, "This type of asset inventory application
is used to discover and document devices and characteristics
such as services, users and groups."
Is this a licensing tool, an audit tool,
an enumeration tool, or a mapping tool?
This is an asset inventory application, right?
And what are we trying to do?
We're trying to discover and document devices,
as well as their characteristics, right?
What services are running, what users, what groups?
You know, maybe even what applications?
So we're really trying to get information
about those devices.
Licensing tools, audit tools,
enumeration tools, or mapping tools?
Put me on pause if you need to.
Well, I'm gonna choose enumeration tools
because we're trying to enumerate, right?
All of those characteristics.
List out all those characteristics.
Licensing tools we tend to use for software, right?
Where we're trying to figure out software licensing,
audit tools have, well, lots of different types of options.
And a mapping tool is when we're trying to create a map
of our network or our infrastructure.
Do you agree?
Let's check.
And that is correct.
"As Information Security Officer,
you've instituted a practice that all media
containing sensitive data be destroyed
at the end of its useful life.
Now, you receive a proposal from a destruction company
that outlines the techniques that they use.
Which technique would not," again,
"Not" is the important word here.
"Which technique would not be in keeping
with your requirements?"
Sanitization, pulping, pulverizing, or shredding?
What's your policy?
Your policy is that all media
containing sensitive data be destroyed,
the media be destroyed.
So the destruction company says, "Okay,
here are your options, what do you want?"
And you look at them and you say, "Well,
that looks pretty good, but there's one
that's definitely not in keeping with my requirements."
Is that sanitization, pulping, pulverizing, or shredding?
Well, I'm gonna choose sanitization,
which is really another way of saying disc wiping,
which is when we are overriding the disc multiple times
with ones, or zeros, or random characters.
The other three, pulping, pulverizing, and shredding
are all destruction mechanisms, agree?
Let's check, and we are correct.
Question 4, "One of the business units at your company
is using an application that was released
on August 1st, 2011.
The published EOL is five years,
and the EOS is an additional five years.
The department manager remarked
that they've never encountered any software issues,
and that the software meets their needs."
So my question to you is,
"Would you consider this a security issue?"
"Yes, it is, because of the end of life date.
No, because the software software's working just fine.
It's working as intended.
Yes, because updates and security patches
are no longer available,"
or, "No, no because there appears to be no need
for support or product maintenance."
Go ahead, put me on pause,
read through that situation again.
Read through those answers.
What do you think?
So you know, there may be a tendency
to get to yes, because of the EOL date,
but you know there's really a better answer here.
It's not just because it's end of life.
What else do we know?
We said that the EOL was five years
and the EOS was an additional five years.
So it was released in 2011, right?
So 2011 plus five, 2016, right?
It's gonna be EOL, and another five years, 2021, right?
It reached its end of support.
And what do we know about end of support
that makes it so dangerous?
Well, how about the answer that says, "Yes,
because updates and security patches
are no longer available."
So just reaching the end of life date,
well, that is an issue, right?
For features and functionalities,
but it's not as much a security issue,
because we're still getting our support,
including our patches.
"No, because the software's working as intended."
Well, it might be,
but now that software is vulnerable, right?
And we have really opened up an attack surface,
and, "No, because there appears to be no need
for supportive maintenance."
Well, the product might be working great.
That's what the department manager said,
but the department manager probably doesn't realize
the implications of having vulnerable software
being exposed in your environment.
So we're going with, "Yes, because updates
and security patches are no longer available."
Agree?
All right, well, let's check it out.
And that is correct.
All right, our last question.
"Your company's Revenue Service requires tax records
to be kept for seven years.
How would this best be codified?
Legal hold documentation, a data backup policy,
a data archiving strategy, or a data retention strategy?"
Your country's Revenue Service says you've gotta
keep tax records for seven years.
The next line says, "How is this best gonna be codified?"
Now, that's important that you read this correctly,
because it doesn't say, how would this best be accomplished?
It says, "How would this best be codified?"
How would you document this, right?
How would you communicate this?
Legal hold documentation, a data backup policy,
a data archiving strategy, or a data retention strategy?
What do you like?
Well, I'm gonna choose data retention strategy,
and here's why.
A retention strategy would be our policy
or our set of rules about what we're going to keep,
what we're gonna archive.
So we would be saying, in this case, we have a rule
is that for seven years,
we are going to keep our tax records.
It wouldn't be legal hold documentation,
because we haven't received a legal hold.
It's not our data backup policy,
because retention archiving is totally different
than data backup.
Remember, data backup just backs up
what's ever in production,
so it could be backing up modified files,
and it's not our archiving strategy.
Our archiving strategy is how we're doing
the archiving, right?
How are we making that happen?
That would really be the implementation.
So archiving is the implementation
of our data retention strategy.
So I'm going with data retention strategy,
and I'm sticking with that answer.
You agree?
All right, let's try it out.
And that is correct.
Another great job, congratulations.
Up next, we're gonna go into Lesson 16,
which is explain Various Activities
Associated with Vulnerability Management.
You ready?
Okay, I'll see you there.