Domain 5
Data hadling
All ideas, data, information, or knowledge can be thought of as performing six major sets of activities throughout its lifetime: Create, Store, Use, Share (by copying or moving), Archive, Destroy. Some rules may apply to each of these activities, including retention periods, access permissions, sharing restrictions, storage requirements, archival procedures, and secure destruction methods. For instance, storage media containing sensitive data may need to be degaussed or physically destroyed before disposal.
Data hadling
To determine which rules apply to a given data asset, organizations classify information according to its sensitivity. Classification answers the question, “How sensitive is this information?” and determines the required labeling, handling, storage, sharing, and disposal requirements. In practice, organizations typically use a small number of classification levels (e.g., Highly Restricted, Moderately Restricted, Low Sensitivity, and Public), as having too many classifications becomes difficult to manage consistently. Labeling is the process of applying the classification to a specific piece of information. A label identifies the asset’s classification and may include additional handling instructions or metadata, providing more detailed guidance without creating additional classification levels. In addition to classification and labeling, organizations define retention and destruction practices to control how long information should be kept and how it must be securely disposed of when it is no longer required.
Encryption
Encryption using asymmetric cryptography relies on a pair of keys: a public key and a private key. The public key can be shared openly and is used by an algorithm to encrypt data, while the private key is kept secret and is required to decrypt the information. This ensures that data can be securely transmitted over a network, as only the holder of the private key can access the original message.
The opposite of encrypted data is plaintext. Plaintext refers to data in its original, unencrypted form before encryption is applied. It does not necessarily mean that the data is human-readable; for example, an unencrypted audio file, image, or binary file is still considered plaintext because it has not been transformed through encryption.
Asymetric and symetric encryption
Asymmetric encryption uses two keys: a public key to encrypt data and a private key to decrypt it. A user or server generates this key pair, keeps the private key secret, and shares the public key with others. This allows users to encrypt sensitive data before sending it over the internet, ensuring that only the intended recipient, who possesses the private key, can decrypt it.
The main disadvantage of asymmetric encryption is its performance. It is significantly slower than symmetric encryption, especially when encrypting large amounts of data.
In symmetric encryption, the same key is used for both encryption and decryption. It works much like a traditional lock: anyone with the key can access the encrypted data. While symmetric encryption is fast and efficient, it presents several challenges. The shared key must be exchanged securely and should never be transmitted over the same channel as the encrypted data, as an attacker who obtains both the key and the ciphertext can decrypt all communications. Additionally, every party with the shared key can both read and modify the data, making it difficult to verify the sender’s identity. Finally, symmetric encryption does not scale well, as each pair of users requires a unique shared key to communicate securely.
Configuration Management
Configuration Management is mainly about the IT system and its components and is a process and discipline used to ensure that all changes made to an information system are authorized, controlled, tested, and documented. Main components are:
- Identification - Identifying and docuemnting the components of a system (incl. hardoware, software, data, interface, documentation, etc).
- Baseline - minimum level of protection that can be used as a reference point before any imporvements.
- Change control - Prevents unauthorized changes by adding a review and approval process.
- Verification and audit - Includes testing, validation, and regression checks to ensure that implemented changes work correctly and audits confirm that the current system configuration matches the approved baseline
Changes are risky so you need to have a rollback plan before uplying any changes to a system.
Commmon security policies
Security policies define rules, responsibilities, and controls to protect organizational assets and ensure compliance with legal, regulatory, and contractual requirements.
- Data Handling Policy - Defines data classification and rules for accessing, storing, sharing, and protecting information (e.g., encryption requirements, confidentiality levels, retention).
- Password Policy - Defines authentication requirements, password standards, and user responsibilities for secure access.
- Acceptable Use Policy (AUP) - Defines permitted usage of company systems, devices, networks, and data to reduce misuse and legal risk.
- BYOD Policy - Defines security requirements for personal devices used for business purposes, balancing flexibility with loss of control and privacy risks.
- Privacy Policy - Defines how personal data (PII/ePHI) is collected, processed, protected, and disclosed according to applicable regulations.
- Change Management Policy - Controls system changes through approval, implementation, and verification processes to prevent introducing vulnerabilities or breaking operations.
Each of these policies should have a penalty or a consequence attached in case of noncompliance. The First time may be a warning; the next might be a forced leave of absence or suspension without pay, and a critical violation could even result in an employee’s termination.
Change Management
Change management ensures that system modifications are planned, evaluated, approved, tested, implemented, and documented in a controlled manner. Changes typically start with a Request for Change (RFC), undergo risk assessment and approval, are tested before deployment, and include rollback procedures to restore the previous state if problems occur. The process provides traceability and minimizes the risk of introducing failures or security issues.
Security awareness training
Training for people to know what is expected of them through multiple types of activities:
- Education – Builds general knowledge and understanding.
- Example: A course explaining the principles of information security and why protecting company data is important.
- Training – Teaches specific skills and procedures required for a role.
- Example: Learning how to identify phishing emails, create strong passwords, or securely handle confidential documents.
- Awareness – Reinforces security-conscious behavior through regular reminders and communication.
- Example: Phishing simulation campaigns, security posters, monthly newsletters, or short email reminders about new threats.
Organizations should promote security awareness through regular training and simple reminders. Simulated phishing emails with rewards for employees who report them, along with items like stress balls or stickers reminding users to lock their computers, help reinforce good security habits.
Passwords
A 10-digit numeric password can be cracked in around 5 seconds using a brute-force attack against a password hash (see below). An 8-character password may take around 35 days to crack, while a 16-character password that includes at least one uppercase letter and one special character could take approximately 152,000 years.
Strong password security goes beyond password complexity. It also means never sharing passwords with IT support or anyone else, avoiding writing them down in insecure locations, and never reusing the same password across multiple services.
As the number of online accounts has increased, managing unique passwords for every service has become increasingly difficult. This has led to the widespread adoption of password managers, which securely store and generate strong, unique passwords. While a password manager creates a single point of failure—if its master password is compromised, all stored credentials may be at risk—it remains one of the most effective ways to improve password security when used correctly. Organizations should provide employees with a trusted, company-approved password manager and encourage its proper use.
Hashing
Hashing takes an input of almost any size and produces a fixed-length value called a hash. A good hashing algorithm is deterministic (the same input always produces the same hash), fast to compute, non-reversible, resistant to collisions, and capable of detecting even the smallest changes to the input.
To verify that a message has not been modified during transmission, the sender includes the hash of the message alongside the message itself. The receiver computes the hash of the received message and compares it with the original. If the two hashes match, the message has not been altered.
The main limitation of this approach is that if an attacker intercepts and modifies both the message and its hash, they can generate a new hash for the altered message, making it appear legitimate. This is why hashes alone do not provide authenticity and are often combined with digital signatures or Message Authentication Codes (MACs).
Social engineering
Social engineering is an essential part of any security awareness program because attackers know it works. Instead of targeting technical vulnerabilities, they exploit the people who have access to sensitive data, making employees one of the most common attack vectors.
Phishing
Another common social engineering type attackers steal passwords is through phishing. Phishing attacks target individuals, departments, or entire organizations using emails, phone calls, text messages, fake websites, or malicious file attachments. Their goal is to trick users—especially those with privileged access—into revealing credentials or other sensitive information.