3.1 Information Asset Protection & Access Controls

Information Asset Protection & Access Controls

Information asset protection is a foundational pillar of modern enterprise security management. In an increasingly digital and interconnected global economy, an organization's intellectual property, financial records, customer data, and trade secrets often represent its most valuable assets. Security managers preparing for the ASIS Associate Protection Professional (APP) examination must understand the theoretical frameworks, governance structures, access control models, and physical and logical safeguards required to protect information assets throughout their lifecycle.

---

The CIA Triad: Core Information Security Pillars

The CIA Triad—comprising Confidentiality, Integrity, and Availability—serves as the fundamental model for evaluating and implementing information security controls. A balanced security program addresses all three pillars while aligning controls with operational requirements.

Balancing Security and Usability

A primary challenge in information asset protection is managing the tension between security controls and operational usability. Overly restrictive confidentiality controls can impede business productivity, leading employees to bypass security mechanisms ("shadow IT"). Conversely, prioritizing availability without adequate integrity or confidentiality controls exposes the organization to catastrophic data loss and regulatory non-compliance.

---

Data Classification Schemes

A Data Classification Scheme categorizes an organization's information assets based on their sensitivity, value, and potential impact if compromised. Classification establishes standardized handling, storage, transmission, and destruction protocols across the enterprise.

Standard Corporate Data Classification Tiers

1. Restricted / Secret (Highest Sensitivity):

   • Definition: Highly sensitive proprietary data where unauthorized disclosure would cause grave, catastrophic harm to the organization's legal standing, market position, or solvency.
   • Examples: Unreleased product source code, trade secret formulas, M&A strategy documents, executive health records.
   • Handling Rules: Strict end-to-end encryption, multi-factor authentication required for access, no storage on unencrypted portable media, mandatory audit logging.

2. Confidential (High Sensitivity):

   • Definition: Sensitive internal data protected by statutory, regulatory, or contractual mandates.
   • Examples: Personally Identifiable Information (PII), Payment Card Industry (PCI) data, employee payroll records, internal audit reports.
   • Handling Rules: Role-based access restrictions, encrypted transmission across public networks, clear labeling on physical and electronic assets.

3. Internal / Unrestricted (Moderate Sensitivity):

   • Definition: Operational data intended for internal enterprise use that is not critical to competitive advantage but not intended for public distribution.
   • Examples: Internal organization charts, standard operating procedures (SOPs), company intranet announcements, general corporate emails.
   • Handling Rules: Standard network authentication required; non-public disclosure prohibited without authorization.

4. Public (Lowest Sensitivity):

   • Definition: Information explicitly approved for public release where disclosure presents no risk to the organization.
   • Examples: Marketing brochures, published press releases, job postings, public financial statements.
   • Handling Rules: No confidentiality restrictions; integrity controls applied to prevent unauthorized defacement or modification.

---

Physical and Logical Access Control Models

Access control regulates how individuals (subjects) interact with physical facilities or digital systems (objects). Effective access control enforces the Principle of Least Privilege (users receive only the minimum access necessary to perform their job duties) and Separation of Duties (critical tasks require multiple individuals to execute, preventing single-point fraud).

   ┌──────────────────────────────────────────────────────────┐
   │                  Access Control Models                   │
   └────────────────────────────┬─────────────────────────────┘
                                │
       ┌────────────────────────┼────────────────────────┐
       ▼                        ▼                        ▼
┌──────────────┐         ┌──────────────┐         ┌──────────────┐
│  Mandatory   │         │Discretionary │         │  Role-Based  │
│ Control (MAC)│         │ Control (DAC)│         │ Control (RBAC│
└──────┬───────┘         └──────┬───────┘         └──────┬───────┘
       │                        │                        │
  Labels & Rules           Owner Decision           Job Function
(OS Enforced)            (User Granted)           (Group Policy)

1. Mandatory Access Control (MAC)

• Mechanism: Access rights are determined by a central authority and enforced by the operating system or system kernel based on security labels assigned to subjects (clearance level) and objects (classification level).
• Key Characteristic: Resource owners cannot modify access permissions or transfer access rights to other users.
• Primary Environment: High-security government, military, and intelligence environments.

2. Discretionary Access Control (DAC)

• Mechanism: Access rights are determined by the data owner, who has full discretion to grant or revoke access to specific users or groups.
• Key Characteristic: Highly flexible, but prone to access control sprawl and unauthorized propagation of access rights.
• Primary Environment: Standard commercial operating systems, shared network drives, and small business networks.

3. Role-Based Access Control (RBAC)

• Mechanism: Access permissions are mapped to specific job roles or functional responsibilities within the organization rather than individual identities.
• Key Characteristic: Simplifies identity lifecycle management; when an employee changes positions, updating their assigned role automatically updates all associated permissions.
• Primary Environment: Enterprise IT applications, Enterprise Resource Planning (ERP) systems, and corporate physical access control systems (PACS).

4. Attribute-Based Access Control (ABAC)

• Mechanism: Evaluates fine-grained attributes of the subject, object, action, and environment (e.g., user department, time of day, location, device security stance) dynamically at the moment access is requested.

---

Safeguarding Sensitive Assets & Secure Destruction

Data Loss Prevention (DLP)

Data Loss Prevention (DLP) tools monitor, detect, and block sensitive data from unauthorized exfiltration across three states:

• Data in Use: Monitoring endpoint actions (e.g., blocking copy-paste to unapproved applications or unauthorized USB drives).
• Data in Transit: Inspecting network traffic (email attachments, web uploads) for matching classification markers or regex patterns (such as Social Security numbers or credit card numbers).
• Data at Rest: Scanning internal servers, databases, and cloud repositories to identify unencrypted sensitive files.

Clean Desk and Clear Screen Policies

Physical security and information security intersect directly in physical work environments. A Clean Desk and Clear Screen Policy mandates that employees lock their computer screens (Windows+L / Ctrl+Cmd+Q) whenever leaving their workstation and store all sensitive physical documents in locked pedestals or filing cabinets when unattended.

Secure Media Destruction & NAID Standards

When physical documents or electronic storage media reach the end of their retention lifecycle, secure destruction prevents unauthorized data recovery.

• NAID AAA Certification: The National Association for Information Destruction (NAID), part of i-SIGMA, establishes internationally recognized standards for mobile and plant-based destruction of paper, hard drives, and electronic media.
• Destruction Methodologies:
  • Paper Documents: Cross-cut or micro-cut shredding adhering to DIN 66399 particle size standards (Level P-4 or higher for confidential documents).
  • Magnetic Media (Hard Drives, Tapes): Degaussing (exposing media to a powerful magnetic field to disrupt magnetic domains) followed by physical destruction (shredding or crushing).
  • Solid State Drives (SSDs): Cryptographic erasure followed by specialized disintegration, as degaussing is ineffective against flash memory.