Asset Identification & Asset Classification 1. What is the purpose of identifying IT assets and inventory? i. To help identify areas of potential risks. 2. What is the purpose of an asset classification? ii. To evaluate the health of the company by examining how well each of the company’s assets are performing. 3. For the scenario you picked, give three (3) examples of customer privacy data elements. (HIPAA) iii. Names iv. Medical records v. Health plan beneficiary numbers 4. Why is your organization’s website classification minor nut its e-commerce server considered critical for your scenario? vi. Because it presents a smaller threat while the e-commerce server is more valuable to the organization. 5. Why would you classify customer privacy data and intellectual property assets as critical? vii. They are valuable assets to the organization and possess value to the organization. 6. What are some examples of security controls for recent compliance law requirements? viii. Sarbanes-Oxley Act – To certify the accuracy of financial information. ix. Children’s Online Privacy Protection Act – Information from children under the age of 13. 7. How can a Data Classification Standard help with asset classification? x. Classifying data helps prevent vulnerability to sensitive data. 8. How can you minimize leakage of customer privacy data through the public internet? xi. Gramm-Leach-Bliley Act (GLBA) – Protects some types of consumer financial information. 9. Given the importance of the Master SQL database that houses customer privacy data and intellectual property assets, what security controls and security countermeasures can you apply to help protect these assets? xii. Cryptography xiii. Monitoring and analysis 10. From a legal and liability perspective, what recommendations do you have for ensuring the confidentiality of customer privacy data throughout the Mock IT Infrastructure? xiv. Contracts xv. Organizational governance