Domain 2: Asset Security
Classification levels
Commercial: Public → Internal → Confidential → Restricted (increasing sensitivity). Government: Unclassified → Sensitive but Unclassified (SBU) → Confidential → Secret → Top Secret.
Classification criteria = the impact if the data is disclosed, altered or destroyed. The data owner classifies; handling rules follow the label.
Sensitive data types
- PII – identifies a person (name + email/Aadhaar/passport).
- PHI – health information (think HIPAA).
- NPI – financial/credit data.
- Proprietary – business-advantage data (trade secret).
Privacy by design: proactive, privacy as the default, embedded in design, full lifecycle protection, visibility, user-centric.
Data states and protections
| State | Example protection |
|---|---|
| At rest | AES-256 full-disk encryption, TDE for databases, key vault |
| In transit | TLS 1.2+/1.3, IPsec VPN, SSH |
| In use | homomorphic encryption, secure enclaves/TEE, memory protection |
Supporting tools: DLP (endpoint/network/email), CASB for cloud, DRM for documents, tokenisation/masking for test data.
The data lifecycle
Create → Store → Use → Share → Archive → Destroy. At each step know: who owns it, what label it carries, what handling rules apply (labelling, encryption, logging), and how retention is enforced.
Retention, legal hold, eDiscovery
Keep records for the longest applicable requirement (regulation, contract, business need) — not “forever” (over-retention is liability). A legal hold suspends destruction when litigation is expected. eDiscovery = finding and producing electronically stored information.
Media sanitisation (NIST SP 800-88)
| Method | What it does | Use when |
|---|---|---|
| Clear | overwrite / block erase | media stays in-house |
| Purge | degauss, cryptographic erase | media leaves trust but is reused |
| Destroy | shred, disintegrate, incinerate | highly sensitive or damaged media |
Data remanence = recoverable residue after deletion. SSDs make overwriting unreliable — prefer cryptographic erase (destroy the key) or physical destruction. Verify sanitisation and keep certificates of destruction.
Asset & hardware lifecycle
Inventory (CMDB), track ownership, patch/upgrade until end-of-life, then sanitise and dispose. EOL = no more sales; EOS = no more support/patches — unsupported assets are an accept-risk decision owned by management, not by IT quietly forgetting them.
Memory hooks
- Government order: Unclassified → SBU → Confidential → Secret → Top Secret.
- Clear (reuse in-house) → Purge (reuse elsewhere) → Destroy (highest sensitivity).
- RPO feels like an asset/data question — it belongs to backup design (see D7).
- Salting defeats pre-computed rainbow tables (ties into D5 hashing).
Exam tips
- Classification is decided by impact of compromise, and by the data owner — not by IT convenience.
- SSD + ‘overwrite’ = wrong answer; use crypto-erase or destroy.
- Data in use = processing; the exam loves TEE/secure enclave for this state.
- Masking/tokenisation for non-production data beats encrypting copies.