Certified Information Systems Security Professional (CISSP) Asset Security Syllabus

Define data remanence.

The residual physical representation of data that remains on storage media even after attempts to erase or delete it.

List the three NIST SP 800-88 sanitization categories from least to most thorough.

Clear (logical overwrite, resists keyboard attacks), Purge (renders recovery infeasible even with lab techniques, e.g., crypto erase/degauss), and Destroy (physical destruction).

What is degaussing and which media does it work on?

Using a strong magnetic field to disrupt the magnetic domains and erase data on magnetic media (HDDs, tapes); it does NOT work on SSDs or optical media.

Why is degaussing ineffective for SSDs?

SSDs store data in flash memory cells (non-magnetic), so a magnetic field cannot erase them; cryptographic erasure or physical destruction is used instead.

What is cryptographic erasure (crypto-shredding)?

Sanitizing data by destroying the encryption keys, rendering the still-present encrypted data permanently unreadable; effective for SSDs and cloud storage.

Compare 'deleting' a file with 'sanitizing' media.

Deletion only removes the file pointer/index entry, leaving recoverable data (remanence); sanitization (clear/purge/destroy) actually removes or destroys the data so it cannot be reconstructed.

Name common physical destruction methods for storage media.

Shredding, disintegration, pulverizing, incineration, and melting.

What is PII (Personally Identifiable Information)?

Any information that can identify a specific individual, alone or combined with other data — e.g., name, SSN, biometrics, address, or account numbers.

What is PHI and which US law governs it?

Protected Health Information — individually identifiable health data — governed in the US by HIPAA (Health Insurance Portability and Accountability Act).

What is the difference between anonymization and pseudonymization?

Anonymization irreversibly removes identifiers so individuals can never be re-identified; pseudonymization replaces identifiers with tokens that CAN be reversed using separately held additional information.

Name the core GDPR data subject rights a CISSP should know.

Right to access, rectification, erasure ('right to be forgotten'), restriction of processing, data portability, and to object to processing.

What is data sovereignty?

The concept that data is subject to the laws and governance of the nation in which it is physically located or collected.

What is data localization (data residency)?

A legal requirement that certain data about a country's citizens be collected, processed, and/or stored within that country's geographic borders.

Why are data sovereignty and localization important when using cloud providers?

Cloud data may be stored in multiple jurisdictions; the organization must ensure storage location complies with applicable laws (e.g., GDPR limits on transfers outside the EU).

What is a security baseline?

A minimum set of security controls/configurations established as a starting standard that all systems of a given classification or type must meet.

Define scoping in the context of applying a security baseline.

Reviewing baseline controls and selecting (or excluding) those that apply to a specific system — removing controls that are not relevant to the environment.

Define tailoring in the context of security baselines.

Modifying or customizing the scoped baseline controls to align precisely with the organization's specific mission, risk, and operating environment (adjusting, supplementing, or applying compensating controls).

State the relationship between baselines, scoping, and tailoring as a process.

Start with a baseline (minimum controls), apply scoping to remove non-applicable controls, then tailor to customize the remaining controls to the organization's needs.

What is Data Loss Prevention (DLP)?

A set of technologies and processes that detect and prevent unauthorized use, exfiltration, or transmission of sensitive data by monitoring data in use, in motion, and at rest.

Differentiate network-based DLP from endpoint-based DLP.

Network DLP inspects data in motion at network egress/gateways; endpoint (host) DLP runs on devices to monitor data in use and at rest, including offline actions like USB copying or printing.

What is the difference between data at rest, data in transit, and data in use?

At rest = stored on media/disk; in transit (in motion) = moving across a network; in use = actively being processed in memory/CPU.

What is the primary control for protecting data at rest?

Encryption (e.g., full-disk encryption, file/database encryption) along with access controls; encryption protects confidentiality if media is lost or stolen.

What is the primary control for protecting data in transit?

Transport encryption protocols such as TLS, IPsec/VPN, and SSH that protect confidentiality and integrity of data moving across networks.

Which protocol secures web traffic and what does it use under the hood?

HTTPS, which uses TLS (Transport Layer Security) to provide encryption, integrity, and server authentication.

What is Digital Rights Management (DRM)?

Technology that enforces persistent access and usage restrictions on digital content (copy, print, forward, expiration) even after it leaves the originating system.

Name common DRM enforcement controls.

License/permission management, encryption tied to entitlements, persistent online verification, expiration/time-bombing, and copy/print restrictions.

What is data obfuscation?

Techniques that hide or obscure the true value of data to reduce its sensitivity — including masking, tokenization, and anonymization.

What is data masking and give a typical example.

Replacing sensitive data with realistic but fictitious or partially hidden values — e.g., showing a credit card as ****-****-****-1234 — often for non-production or display use.

What is tokenization and how does it differ from encryption?

Tokenization substitutes sensitive data with a non-sensitive token that maps back to the original via a secure lookup table (vault); unlike encryption, the token has no mathematical relationship to the data, so there is nothing to decrypt.

What does data labeling/marking provide and how does it differ from classification?

Classification is the decision about sensitivity level; labeling/marking is the physical or electronic application of that classification tag to the asset so handlers know how to treat it.

When data of different classifications are combined, what classification should the resulting aggregate receive?

At least the highest classification of any component data — and aggregation may itself raise sensitivity (the aggregation problem), where combined low-level data reveals high-level information.