1. Actions that can damage an asset
A threat: Flood, earthquake, severe storms. 2. Laws to protect private financial information * Federal information security management act(FISMA) * Sarbanes Oxley act (SOX) * Gramm leach Bliley act(GLBA) * Health insurance portability and accountability act(HIPAA) * Children’s internet protection (CIPA) * Family educational rights and privacy act (FERPA) 3. Parts of layered security that supports confidentiality * Defining organization wide policies, standard, procedures, and guidelines to protect confidential data. * Adopting a data classification standard that defines how to treat data throughout AT. * Limiting access to systems and application that house confidential data to only those authorized to use it * Using cryptography techniques to hide confidential data to keep it invisible to unauthorized user * Encrypting data that crosses the public internet. * Encrypting data that is stored within databases and storage devices 4. Definition of policy, standard, guide, procedure * Policy: is written statement that the people in charge of an organization have set as a course of action or direction. Come from upper management-apply to whole organize * Standard: detail information for hardware and software, how it use-ensure consistent security controls are used throughout IT system * Procedure: instruction for how to use policies and standards: plan of action, install, test, auditing * Guidelines: suggest course of action for using the policy, standard or procedure. 5. Definition of classification of data * Goal and objective of DCS is to provide a consistent definition for how an organization should handle and secure different types of data: private data, confidential, internal use only, and public domain data. 6. Result of lapse in security