L5 · Information Asset Protection
Threats, access control, cryptography, perimeter design and physical security — the controls that protect confidentiality, integrity and availability. Maps to Domain 5 (Protection of Information Assets).
Exam relevance. D5 is 26% — the largest block alongside D4. Most questions are classification questions: is this control administrative, physical or technical; preventative, detective or corrective?
The framing
- Protecting information assets is a big challenge, and most organisations view security as primarily a perimeter defence.
- Confidential access is often achieved through a secret tunnel — a VPN.
- Information asset protection means ensuring adequate safeguards to store, access, transport and dispose of confidential information.
- The auditor must understand how controls promote confidentiality, integrity and availability.
Three types of access control
| Type | Examples |
|---|---|
| Administrative | Agreements, contracts, policies |
| Physical | Security guards, protective barriers, locks |
| Technical | Software protection, ACLs, authentication |
The auditor evaluates the implementation, the processes and the procedures — not just the existence of a document.
Threats and computer crimes
| Crime | Definition |
|---|---|
| Theft | Theft of information, designs, plans, customer lists |
| Fraud (cheat) | Misrepresentation to gain an advantage; electronic records may be remotely manipulated for deceit, suppression or unfair profit |
| Sabotage (destroy) | Wilful and malicious destruction of company property |
| Blackmail | Unlawful demand for money or property under threat of harm |
| Industrial espionage | Spying by individuals and governments to gather or release information to the advantage of a foreign organisation |
| Unauthorised disclosure | Release of information without permission |
| Loss of credibility | Damage to image, brand or executive management — fraud, sabotage, blackmail and disclosure are all used to destroy credibility |
| Loss of proprietary information | Mishandling of system designs, marketing plans, corporate formulas |
| Legal repercussions | Breach of control or loss of an asset creates undesirable attention |
Who attacks
| Actors | Definition | Audit implication |
|---|---|---|
| Hacker | A programmer able to create usable programs where none existed; wants to break in, take over and damage processing; seeks to exceed authorised privileges | Monitor systems and act swiftly on any attempt to gain higher access. Both internal and external. Internal hackers are usually terminated and pursued legally |
| Cracker | Breaks into a system illegally or unethically without authorisation, using existing tools | Tooling lowers the skill barrier |
| Script kiddie | Executes scripts and programs written by others to hack a machine — password decryptors, automated access utilities | Volume attacker; still a real incident |
Passive vs active attacks
| Passive | Active | |
|---|---|---|
| Method | Observation | Intervention |
| Purpose | Gain information before launching an active attack | Cause effect |
| Examples | Network analysis, traffic analysis, eavesdropping | DoS, social engineering, phishing, dumpster diving, virus/worm, trojan, logic bomb, email spam and spoofing, message modification, trapdoor, brute force, packet replay |
| Detectability | Hard — nothing changes | Easy to detect (the slide's own note) |
Trap: dumpster diving is described in the lecture as "a legal way" — it is legal because the material was discarded, but it remains an active attack and a serious control failure (no shredding).
Logic bomb — intentionally inserted into software, awaiting detonation by a trigger.
Who owns security
| Role | Responsibility |
|---|---|
| CSO — Chief Security Officer | Highest authority granted to the senior information systems security officer; defines and enforces security policies |
| CPO — Chief Privacy Officer | Equal to, or directly below, the CSO; protects confidential information of clients and employees |
| ISSM — Information Systems Security Manager | Day-to-day process of ensuring compliance with system security |
Security governance is built on policies, standards and procedures, and requires an information classification programme.
Classification scheme
| Class | Who may see it | Examples |
|---|---|---|
| Public | Anyone — reviewed and edited to convey the correct message | Website, sales brochures, marketing, press releases, legal filings |
| Sensitive | Certain parties, not everyone | Client lists, product pricing structure, contract terms |
| Private | Internal use only | Salary data, employee performance reviews |
| Confidential | Not shared outside the organisation, and not with all internal employees | Secret recipes, employee records |
Data retention: the classification drives how long data is kept and how it is destroyed — keep too long and you enlarge the breach surface; destroy too early and you lose evidence and legal defensibility.
The document access path
You cannot secure a building you cannot draw. The network administrator or security manager should hold a building floor plan marking:
- Computer systems · wiring closets · computer rooms
- Network jacks · telephone jacks · modems
- Physical access doors and locking doors
Then:
- Perform risk assessment against that map of access paths.
- Hackers love to start in an unsupervised conference room — a live network port with nobody watching.
- Give special attention to areas with modem access, which bypasses the internal corporate firewall.
- Monitor change control, because changes alter the access path.
- Provide constant monitoring — cameras, guards, alarms.
- Use badge access, including a mantrap / double-door airlock.
Personnel and physical control
Education and training is the best defence
It is a preventative control. Cover: new-hire orientation · physical security safeguards and asset protection · re-educating existing staff · new security and safety considerations · email security · virus protection · business continuity.
Physical access — what the auditor investigates
- How access is granted to employees, visitors, vendors and service personnel
- Who is escorted and who is left unattended
- The nature of physical controls and locking doors
The three top concerns of physical access:
- Sensitive areas — computer rooms, network wiring closets
- Service ports — network equipment, routers, servers
- Computer consoles — direct access to servers
Terminating access
- Terminate on leaving the organisation or changing position.
- Review existing access regularly.
- Flag anyone with more access than the job requires, or with access to sensitive areas they do not need.
- Implement least privilege.
Trap: a mover is as dangerous as a leaver. Most access-review failures are transfers, not departures.
Incident handling
Physical damage, or an unlocked door at the wrong time, should initiate the incident-handling process. The auditor asks:
- What events trigger incident response?
- What is the process for activating the response team?
- Does the team have an established procedure to investigate properly and protect evidence?
- Are team members formally appointed and trained?
Implementing physical protection
| Technique | Notes from the lecture |
|---|---|
| CCTV | Real-time monitoring or audit logs of past activity; monitor access routes |
| Guards | Highly preferred — observe details a computerised system ignores; provide crowd control in an emergency |
| Special locks | Traditional tumbler, electronic lock, cipher lock |
| Biometrics | See below |
| Burglar alarm | Signals that a particular door was opened |
Application software control
A combination of user identity, authentication, authorisation and accountability.
- User identity — a claim that must be authenticated (verified).
- Accountability — holding a person responsible for their actions.
- Most software uses access control lists (ACLs) to assign rights or permissions.
Biometrics and the two error types
Includes fingerprints, retina scan, face scan, palm scan, signature dynamics and voice pattern. Biometric data must be protected through initial collection, distribution and processing.
| Term | Meaning | Effect |
|---|---|---|
| Enrollment | Capturing the reference sample — time consuming | Quality of enrollment sets the ceiling on accuracy |
| False reject — Type 1 error | A valid user is rejected | Inconvenience; users work around the control |
| False accept — Type 2 error | An impostor is accepted | Security failure |
Trap: Type 1 = false reject (annoying). Type 2 = false accept (dangerous). Tightening the threshold trades one for the other — you cannot reduce both with one setting.
Network access protection
- Users demand ease of use, anywhere inside or outside the organisation.
- Single Sign-On (SSO) — convenience, and a single point of credential compromise.
- Firewall — blocks unwanted traffic and access.
DMZ
A demilitarised zone is a physical or logical subnetwork that contains and exposes an organisation's external-facing services to an untrusted network such as the Internet. Purpose: if the public-facing service is compromised, the attacker is still outside the internal network.
SSO risk
One credential opens everything, and compromise of that credential gives access to all connected systems. Compensate with strong authentication, short sessions, and monitoring.
Symmetric vs asymmetric keys
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared secret | Key pair — public and private |
| Speed | Fast; suited to bulk data | Slow; suited to key exchange and signatures |
| Key distribution | The hard problem — how do both sides get the key securely? | Solves distribution: publish the public key |
| Provides | Confidentiality | Confidentiality (encrypt with recipient's public key) and non-repudiation / integrity (sign with sender's private key) |
| Scale | n(n−1)/2 keys | 2n keys |
Trap: to send a confidential message you encrypt with the recipient's public key. To prove origin you sign with your own private key. These two are constantly reversed in options.
Remote access
| Method | Security position |
|---|---|
| Remote dial-up | Over standard telephone lines with modems; completely bypasses the firewall. The auditor must determine whether adequate safeguards prevent this circumvention |
| Remote VPN | Connects remote users over an insecure public network using tunnelling, with SSL and TLS |
| Wireless | SSID concerns — broadcasting invites association attempts; hiding is not a control, strong authentication and encryption are |
TRAPS
- Administrative / physical / technical is the first classification question. Contracts are administrative; guards are physical; ACLs are technical.
- Passive attacks are observation (traffic analysis, eavesdropping); active attacks change something.
- Type 1 = false reject, Type 2 = false accept.
- Encrypt to the recipient's public key; sign with your own private key.
- Symmetric key distribution is the weakness that asymmetric cryptography solves — not "slow encryption".
- Dial-up bypasses the firewall entirely; that is why modem lines are an audit finding.
- Hiding the SSID is not security.
- DMZ exists to keep public services away from the internal network, not to speed them up.
- Access termination must cover transfers, not just leavers.
- Classification drives retention and disposal — one scheme, three decisions.
60-second recall
- Access control types: administrative · physical · technical.
- Crimes: theft · fraud · sabotage · blackmail · industrial espionage · unauthorised disclosure · loss of credibility · loss of proprietary information · legal repercussions.
- Actors: hacker (creates) · cracker (breaks in with tools) · script kiddie (runs others' scripts).
- Passive = observe; active = interfere.
- Roles: CSO (authority, policy) · CPO (equal/below CSO, client and employee data) · ISSM (day-to-day compliance).
- Classification: public · sensitive · private · confidential.
- Three physical concerns: sensitive areas · service ports · consoles.
- Biometrics: enrollment · Type 1 false reject · Type 2 false accept.
- DMZ = public-facing services isolated from the internal network.
- Symmetric one shared key, fast, hard distribution; asymmetric key pair, slow, solves distribution and enables signatures.
- Dial-up bypasses the firewall; VPN tunnels over the public network using SSL/TLS.