Protection of Information Assets

• By the end of this chapter, students will be able to:
  • Explain what information assets are and why they are critical to organizations
  • Describe the role of security governance in protecting information assets
  • Classify information assets based on sensitivity, value, and impact
  • Identify ownership roles and responsibilities for information assets
  • Apply appropriate security controls across different data states
  • Understand data retention, sanitization, and disposal requirements
  • Explain how laws and regulations influence information asset protection

• Organizations must protect information assets because:
  • Information is a core business resource that enables operations and decision-making

Why Protect

• Loss of confidentiality can lead to privacy violations and legal penalties

Information

• Loss of integrity can result in incorrect decisions and operational

Assets?

failures

• Loss of availability can disrupt services and business continuity
• Data breaches damage organizational reputation and stakeholder trust

• Protecting information assets is therefore a strategic, legal, and governance requirement, not only a technical concern.

• Security governance defines how information assets are protected and controlled.
• It ensures:
  • Clear accountability
  • Consistent security practices
  • Compliance with laws and standards
  • Oversight and continuous improvement
• Asset protection is enforced through policies, standards, procedures, and audits.

Security governance is the collection of practices related to supporting, defining, and directing the security efforts of an organization.

Security governance principles are often closely related to and often twisted with corporate and IT governance.

Corporate governance is Doing the right things for the

“

organization and doing things the right way independent of personal interests. ”

• The strategic oversight function that ensures the cybersecurity program aligns with business goals and complies with laws, regulations, and policies.
• Focus: Direction, accountability, oversight, and control. : Senior leadership, board of directors, governance committees.
• Who’s Involved
• Key Questions Addressed:
  • Are we doing the right things ?
  • Are our cybersecurity investments aligned with business risk and value?
  • Are roles, responsibilities, and reporting structures clearly defined?
• Examples:
  • Approving enterprise security policies.
  • Defining acceptable risk levels.

• The operational and tactical activities performed to implement and maintain cybersecurity controls.
• Focus: Execution, operations, monitoring, and incident response. : CISOs, security managers, security analysts, technical staff.
• Who’s Involved
• Key Questions Addressed:
  • Are we doing the things right ?
  • Are controls properly implemented and maintained?
  • Are we responding effectively to threats and vulnerabilities?
• Examples:
  • Deploying firewalls and endpoint protection.
  • Monitoring for cyber incidents.
  • Conducting vulnerability scans and risk assessments.

When using ASPs or cloud providers:

Third-Party

and Cloud

• Organizations remain accountable for data protection

Governance

• Due diligence must be performed before engagement
• Contracts and SLAs must define security responsibilities

Governance ensures third-party risks are managed effectively.

• From a governance perspective:
  • Due care demonstrates responsible operation
  • Due diligence demonstrates proactive risk management
• Both are essential to avoid negligence and legal liability.

• Information classification organizes information assets based on sensitivity and impact.
• Classification helps:
  • Apply appropriate security controls
  • Control access and handling
  • Reduce risk of data exposure

• Information classification is based on evaluating multiple factors, including:
  • Business Value: How critical the information is to operations or competitiveness
  • Legal and Regulatory Impact: Laws requiring protection (e.g., PDPL, GDPR)
  • Reputational Damage: Loss of customer or public trust if disclosed
  • Operational Impact: Disruption caused by unauthorized modification or loss
• A common guiding question is: What is the worst possible impact if this information is disclosed, altered, or destroyed?
• The higher the impact, the higher the classification level and required controls.

(PII) is any information that can identify an individual.

PERSONALLY IDENTIFIABLE INFORMATION

• any information that can be used to distinguish or trace an individual s identity, such as ’ name, social security number, date and place of birth, mother s maiden name, or biometric ’ records; (PHI) is any health-related information that can be related to

PROTECTED HEALTH INFORMATION a specific person.

• received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse;

PROPRIETARY DATA

refers to any data that helps an organization maintain a competitive edge.

• software code, technical plans for products, internal processes, Copyrights, patents, and trade secret laws provide a level of protection for proprietary data etc.

MARKING (often called labeling) sensitive information ensures that users can easily identify the classification level of any data.

Marking includes both physical and electronic marking and labels.

P HYSICAL LABELS

indicate the security classification for the

data stored on assets such as media or processed on a system.

E LECTRONIC LABELS

• as a header and/or footer in a

document, or embed it as a watermark.

• A benefit of these methods is that they also appear on printouts.

• A key goal of managing sensitive data is to prevent data breaches.
• A DATA BREACH is any event in which an unauthorized entity can view or access classified data.

• Record and asset retention refers to keeping information for as long as it is needed for:
  • Business operations
  • Legal and regulatory compliance
  • Audit and accountability purposes
• Retention periods may be defined by:
  • Organizational policies
  • Industry standards
  • Laws and regulations (e.g., 3 years, 7 years, or indefinitely)
• Once the retention period expires, information must be securely destroyed to reduce risk.

• Deleting files is not sufficient.
• Secure destruction prevents:
  • Data recovery
    • A process of retrieving lost, deleted, corrupted, or inaccessible data from storage devices when normal access is no longer possible.
  • Data remanence
    • The data that remains on media after the data was supposedly erased.

• When we no longer need a certain media, we must dispose of it in a manner that ensures that data can't be retrieved. This pertains to both electronic media and paper copies of data.
• Paper Disposal: It is highly encouraged to dispose of any paper with any sensitive data on it in a secure manner. This also has a standard and cross shredding is recommended.
• Digital disposal: The digital disposal procedures are determined by the type of media containing data.

• No single federal data protection law
• Key Laws:
  • CCPA ( California Consumer Privacy Act) / CPRA (California Privacy Rights Act) - gives consumers more control over the personal information that businesses collect about them
  • HIPAA (Health Insurance Portability and Accountability Act) establishing national standards to protect sensitive patient health information (PHI) from unauthorized disclosure.
  • GLBA (Gramm-Leach-Bliley Act) - requires financial institutions, companies that offer consumers financial products or services like loans, financial, investment advice, insurance – to explain their information-sharing practices to their customers and to safeguard sensitive data.
  • Generally, more business-friendly than GDPR

• Information ownership means assigning clear responsibility and authority for a specific information asset to a person or role in the organization.
• The information owner is accountable for how the information is:
  • Classified
  • Protected
  • Used
  • Shared
  • Retained and disposed of
• Example: Student Records at a University:
  • Information asset: Student education records
  • Information owner: Registrar’s Office (or Registrar role)

• Why Ownership Matters:
  • Effective protection requires:
    • Clear accountability
    • Defined decision-making authority
  • Without ownership, security controls cannot be enforced properly.

• Information Ownership (who is the owner)
  • CISO is accountable for the protection of the organizational data.
    • Information owner: Typically a business or department head
      • Determines data classification
      • Approves access rights
      • Ensures appropriate protection
    • Information steward: owns the technical accountability for how information supports business process (Data analytics). Ensures data quality and business usage
    • Information custodian Handles the technical environment and implements measures to protect data. Ensure data is accessible to users as per the guidelines set by the data owner and steward. Implements technical controls
    • Information user is responsible for using the information in accordance with its classification level

• Student Records at a University:
  • Information asset: Student education records
  • Information owner: Registrar’s Office (or Registrar role)
  • System custodian: IT Department
  • Users: Faculty members and academic advisors
• What the owner decides:
  • Who is allowed to access student records
  • Whether the data is confidential or highly sensitive
  • How long records must be kept
  • When data can be shared (e.g., with accreditation bodies)
• What IT does (not the owner):
  • Manages servers and databases
  • Applies access controls
  • Performs backups and security updates

• Many people within an organization manage, handle, and use data, and they have different requirements based on their roles.
• One of the most important concepts here is ensuring that personnel know who owns information and assets.
• The owners have a primary responsibility of protecting the data and assets.

• The asset owner (or system owner) is the person who owns the asset or system that processes sensitive data.

NIST SP 800-18 - responsibilities for the system owner:

• Develops a system security plan in coordination with information owners, the system administrator, and functional end users
• Maintains the system security plan and ensures that the system is deployed and operated according to the security requirements
• Ensures that system users and support personnel receive appropriate security training
• Updates the system security plan whenever there is a significant change
• Assists in the identification, implementation, and assessment of the common security controls

• Identify and classify data & assets correctly
• Apply Principle of least privilege
• Strong Authentication and Identity Security
• Encrypt sensitive data
• Monitor & log access
• Data Loss Prevention (DLP)
• Regular audits and user awareness training

TO

BUSINESS STRATEGY,

GOALS, MISSION, AND OBJECTIVES

• The business/mission owner role is viewed differently in different organizations.
• NIST SP 800-18 refers to the business/mission owner as a program manager or an information system owner.
• The responsibilities of the business/mission owner can overlap with the responsibilities of the system owner or be the same role.
• In businesses, business owners are responsible for ensuring that systems provide value to the organization.

• Security management planning ensures the proper creation, implementation, and enforcement of security policies within an organization.
• The main objective of security management planning is to align security functions with the organization s strategy, goals, mission, ’ and objectives.
• Effective security does not operate in isolation; it supports business priorities and enables safe operations.
• One of the most effective approaches to security management planning is the Top-Down Approach.

• Senior (upper) management is responsible for:
  • Initiating security policies
  • Approving security objectives
  • Defining acceptable risk
• Security policies provide direction and authority for all levels of the organization.
• Top-down support is essential for policy enforcement and accountability.

• The team or department responsible for security within an organization should be autonomous.
• Chief information security officer (CISO) – the leader of Cybersecurity team, must report directly to senior management.

The security management plan include

security roles;

• defining
• prescribing how security will be managed,
• who will be responsible for security.
• how security will be tested for ; effectiveness
• developing security policies ;
• performing ; and risk analysis
• requiring security for employees. education

• These efforts are guided through the development of management plans.

• Online Banking System (Financial Institution)
• A bank provides online and mobile banking services to customers. Its critical information assets include:
  • Customer personal data (PII)
  • Account balances and transaction records
  • Online banking platform
  • Authentication credentials

• Translating Strategy into Actions:
  • To support the strategic goal, the bank develops tactical security plans for the coming year.
• Tactical Security Decisions:
  • Implement multi-factor authentication (MFA) for online banking
  • Deploy encryption for customer data at rest and in transit
  • Introduce Security Information and Event Management (SIEM)
  • Develop an incident response plan
  • Allocate budget for:
    • Security tools, Staff training , and Penetration testing
• Example Tactical Plans:
  • Project plan for MFA deployment
  • Hiring plan for SOC analysts
  • Training plan for employees on phishing awareness
• Tactical plans define which controls will be used to protect information assets.

Thank you