Protection of Information Assets: Exam Tips
Security Frameworks Guide Policy Development
Frameworks such as ISO 27001, NIST CSF, and COBIT provide structured approaches to information security management. ISO 27001 certification requires an information security management system (ISMS) with documented policies, risk assessments, and continuous improvement.
IAM Controls Must Enforce Least Privilege
Identity and access management should enforce the principle of least privilege, granting users only the minimum access needed for their role. Access reviews should be conducted periodically, and privileged accounts require additional controls such as multi-factor authentication and session monitoring.
Network Security Uses Defense in Depth
A defense-in-depth strategy layers multiple security controls (firewalls, IDS/IPS, network segmentation, DMZs) to protect against threats. No single control should be the sole point of protection; if one layer fails, others should detect or prevent the attack.
Encryption Protects Data at Rest and in Transit
Symmetric encryption (AES) is efficient for bulk data, while asymmetric encryption (RSA, ECC) enables key exchange and digital signatures. The IS auditor should verify that encryption key management includes secure generation, distribution, storage, rotation, and destruction processes.
Cloud Security Follows the Shared Responsibility Model
In cloud computing, the provider and customer share security responsibilities based on the service model (IaaS, PaaS, SaaS). The customer always retains responsibility for data classification, access management, and regulatory compliance regardless of the deployment model.
Incident Response Plans Need Predefined Playbooks
Security incident response should follow predefined procedures for detection, containment, eradication, recovery, and lessons learned. The response team should include representatives from IT, legal, communications, and business management with clearly defined roles and communication protocols.
Vulnerability Management Is a Continuous Cycle
Vulnerability management includes asset discovery, vulnerability scanning, risk prioritization, remediation, and verification. Critical and high-severity vulnerabilities should have defined remediation timelines, and compensating controls should be applied when immediate patching is not feasible.
Data Classification Drives Protection Requirements
Data classification (e.g., public, internal, confidential, restricted) determines the level of protection required for storage, transmission, and disposal. The data owner is responsible for assigning the classification, and controls should be applied consistently based on the assigned level.
Security Awareness Training Reduces Human Risk
Regular security awareness training should cover phishing, social engineering, password hygiene, and data handling procedures. The effectiveness of training should be measured through simulated phishing exercises, assessments, and tracking of security incident trends.
DLP Controls Prevent Unauthorized Data Exfiltration
Data loss prevention (DLP) solutions monitor and control data movement across endpoints, networks, and cloud services. DLP policies should be aligned with data classification to detect and block unauthorized transmission of sensitive information through email, web uploads, and removable media.