# Chapter 5 – Protecting Security of Assets

## Identify and Classify Assets
One of the first steps in asset security is identifying and classifying (information) assets.
Assets include sensitive data, the hardware used to process it, and the media that holds it.

### Defining sensitive data
Sensitive data is any information that isn’t public or unclassified.
**Personal Identifiable Information (PII)** is information that can identify an individual.
**Protected Health Information (PHI)** is health-related information that can be related to a specific person. HIPAA further defines it as information that “is created or received by a health care provider, health plan, public health authority, *employer, life insurer, school or university*, or health care clearinghouse”. 
**Proprietary data** is any data that helps an organization maintain a competitive edge.

### Defining data Classifications
A *data classification* identifies the value of the data to the organization. Classification labels, the method by which they are assigned, and the required protection associated with the different labels, are identified in a policy.
US government uses the following classifications:
* **Top Secret**: unauthorized disclosure causes ~exceptionally grave damage~ damage to national security.
* **Secret**: unauthorized disclosure causes ~serious damage~ to national security.
* **Confidential**: unauthorized disclosure causes ~damage~ to national security.
* **Unclassified**: any other data.
(So Top Secret = exceptionally grave damage | Secret = serious damage | Confidential = damage)

Anything above ‘unclassified’ is considered **sensitive data**.

Unclassified is sometimes further subclassified as FOUO and SBU (For Office Use Only and Sensitive But Unclassified - the IRS uses SBU for individual tax records).

While the above classifications are government/military oriented, there are also civilian/commercial classifications:
* **Confidential or Proprietary**: a breach causes ~exceptionally grave damage~ to the mission of the organization. 
* **Private**: a breach causes ~grave damage~ to the mission of the organization. PII and PHI data are often labeled as Private.
* **Sensitive**: a breach causes ~damage~ to the mission of the organization. As an example, data about an organization’s IT infrastructure may be considered Sensitive.
* **Public**: confidentiality is no issue, but integrity may be.

Again, sensitive information is any information that isn’t public or unclassified. 

### Asset Classifications and Security Controls
The above classifications also apply to hardware assets. Asset classification should match data classifications: if a system processes top secret data, the system should be classified as a top secret asset.

After data and asset classifications have been defined, security requirements and security controls can be identified. Management decides on a data security policy that dictates the use of specific security “controls” (requirements ?) for each category.
Security administrators use the requirements from the security policy to identify controls.

### Data states
* **Data at Rest** is data stored on media
* **Data in Transit** (or data in motion) is data transmitted over a network
* **Data in Use** is data in use by an application; it may reside in memory or in  temporary storage buffers.

Organization can mark USB drives for use for storing classified data by using a Universally Unique IDentifier (UUID) that can be recognized by Data Loss Prevention (DLP) systems, ensuring data is encrypted before copying it, or preventing copying by users.

Secure transportation of media is referred to as ‘handling’

### Declassification
For re-purposing, media or systems can be downgraded to a less sensitive classification. It must be sanitized before doing so and organizations should have procedures for that.
Be aware that the value of sensitive data is much greater than the value of the media holding it. The efforts required for secure sanitization are often much greater than the cost of new media.
In most cases it’s better to destroy (classified) media, than to re-use it.

### Destroying sensitive data
Destroying data should follow a procedure based on the data’s classification. NIST SP 800-88r offers “Guidelines for Media Sanitization”. Sanitization can refer to the destruction of media or purging it using a trusted method.

**Data remanence** is the residual data that remains on a medium after is was supposedly erased. Data remanence can be removed with a degausser, but from magnetic media only. 

**Erasing** media is simply performing a delete, which only removes the directory reference to the data, but not the data itself.

In **Clearing** or overwriting, the classified data is overwritten with unclassified (or random) data on all addressable locations of the media. Sometimes this is done in multiple passes with different data patterns.
This doesn’t work equally well for all media types and sometimes parts of the original data can be retrieved using special techniques. 

**Purging** is more thorough then clearing: by definition it provides the assurance that the data is not recoverable with any known methods. It isn’t always trusted in practice.

**Destruction** should lead to a state where the media cannot be reused or repaired, and no data can be extracted from it anymore. It is the most secure method of sanitization.

Degaussing isn’t recommended for Hard Disks as it destroys the electronics. SSD’s are remarkably resilient against any traditional methods of sanitization and can best be destructed. Alternatively all data on the SSD can be encrypted, making it unreadable.

You should always verify, after a sanitization process, that the desired result has been achieved.

### Asset Retention
Retaining important information for as long as it is needed is called *record retention*. Laws and regulation often have requirements for record retention.
*Hardware retention* is retaining the hardware until it has been properly sanitized.
*Personnel retention* refers to the knowledge personnel acquire about the organization, confidentiality is commonly covered through NDA’s.

### Protecting data with Symmetric Encryption

Some commonly used symmetric encryption algorithms:
* Advanced Encryption Standard (AES). Selected by NIST as the replacement for the older Data Encryption Standard (DES) in 2001. The US government has approved it for top secret data. Microsoft’s BitLocker and Encrypting File System (EFS) use AES for file encryption. AES supports 128/192/256 bit keys.
* Triple DES or 3DES was created as a DES replacement. It is used for smart payment cards. 3DES supports 56/112/168 bit keys.
* Blowfish was also created as a DES replacement. Linux systems use ‘bcrypt’ to encrypt passwords. Key sizes of 32 bits to 338 bits are supported. Bcrypt adds 128 additional bits as a salt to protect against rainbow table attacks.

### Protecting data withTransport Encryption
Sniffing attacks are the primary risks when sending unencrypted data over a network. Sniffing attacks use protocol analyzers, or ‘sniffers’.
Web browsers use HTTPS to encrypt e-commerce’s transactions (HyperText Transfer Protocol Secure). The underlying encryption protocol is TLS (Transport Layer Security). Before that, SSL (Secure Sockets Layer) was used but in 2014 a vulnerability to the POODLE attack was discovered.

For remote administrative tasks, Telnet through an encrypted VPN tunnel is not acceptable. Although the traffic from the client to the VPN server is encrypted, the traffic from the VPN server to the Telnet server is not! One should use SSH, SCP or SFTP (Secure Shell, Secure Copy or Secure FTP).

## Ownership
The **data owner** or **information owner** has ultimate organizational responsibility for the data. It is typically the CEO or a departmental manager. Data owners identify the classification of data and ensure its proper labeling. They also ensure the data has adequate security controls based on its classification.
Data owners may be liable if they fail to perform due diligence.

NIST SP 800-18 outlines the information owner’s responsibilities as:
* Establish the rules of behavior (for appropriate use and protection of the data)
* Provide input to system owners regarding security requirements and controls
* Decide who has access and with what privileges or access rights
* Assist in the identification and assessment of security controls.

Rules of Behaviour and Acceptable Use Policy (AUP) are effectively the same thing.

A data owner often delegates everyday tasks to a **data custodian**. The data custodian ensures that data is properly stored and protected, for instance by making sure the data is backed up and auditing logs are kept. Data custodians are typically system security administrators and/or part of the IT department.

The **asset owner** or **system owner** owns the asset or system that processes sensitive data. He/she is responsible for the secure processing of data on that system, for the highest level of data the system processes.

The system owner:
* Develops a system security plan
* Maintains the system security plan
* Ensures that personnel receives appropriate security training and instructions (e.g. rules of behaviour or AUP)
* Assist in the identification, implementation and assessment of security controls.

The role of **business or mission owners** differs per organization. They might own business processes and/or be responsible for ensuring that systems provide value to the organization, though they are not the owners of the systems themselves. Often conflict arises between business owners and IT owners. The implementation of IT governance methods such as COBIT may help to balance security control requirements with business needs.

A **data administrator** is responsible for granting appropriate access and assigning permissions to personnel, based on the principles of least privilege and need to know.


## Data Processors
Under GDPR a data processor is an entity that processes personal data on behalf of a data controller.

The EU-US Privacy Shield is a self-certification mechanism to ensure GDPR compliant transfer of personal data for processing in the US.

The core Privacy Shield principles are:
* *Notice*: informing individuals about the purposes of processing their data
* *Choice*: offer individuals the possibility to opt-out
* *Accountability for Onward Transfer*: data may only be transferred to other organizations if they comply with the ~Notice and Choice~ principles.
* *Security*: organizations must take reasonable precautions to protect personal data.
* *Data Integrity and Purpose Limitation*: only collect data that is needed for the purposes communicated under the Notice principle.
* *Access*: individuals must have access to their data
* *Recourse, Enforcement, and Liability*: organizations must implement mechanisms to ensure compliance and to handle individual complaints.

**Pseudonymization** refers to the replacement of data with ‘artificial identifiers’, like arbitrary patient numbers in medical records. It is similar to *tokenization*. When performed effectively, less stringent GDPR requirements apply. Pseudonymization (tokenization) can be reversed.

**Anonymization** is the process of removing all data that can lead to the identification of a person. If done effectively, the GDPR no longer applies.

*Data masking* can be an effective method of anonymization. Masking swaps data items in individual database columns, so that records no longer represent actual data, but aggregate values are maintained (e.g. for scientific or statistical purposes). Data masking cannot be reversed.

## Using Security Baselines
Baselines define the minimum security standard. NIST SP 800-53 discusses security control baselines and includes a comprehensive list of controls, prioritized as low-impact, moderate-impact and high-impact (referring to the possible effects of a compromise of confidentiality, integrity or availability).
The low-impact category mainly consists of basic security practices, like access control policies, backup policies and imaging.

Selecting the applicable controls for a certain system from a list of baseline security controls is called **scoping**. **Tailoring** refers to modifying the baseline list to align with an organization’s mission.


