Legal Regulations, Compliance, and Investigation

Lab01_CreatingInfrastructureassetList.pdf

Home >Computer Science homework help >Legal Regulations, Compliance, and Investigation

Introduction Privacy is of growing concern, especially that of individual personal information. Between businesses seeking more effective use of their marketing budgets and governments targeting potential hostiles, the individual struggles to keep any information private.

The purpose of an IT asset identification and asset classification exercise is to protect privacy data and implement security controls. Identifying where privacy data is accessed throughout an IT infrastructure or outside of its protected environment is important.

In this lab, you will create an IT asset/inventory checklist organized within the seven domains of a typical IT infrastructure, you will perform an asset identification and classification exercise, you will explain how a data classification standard is linked to customer privacy data and security controls, and you will identify where privacy data resides and what security controls are needed to maintain compliance.

Learning Objectives Upon completing this lab, you will be able to:

• Create an IT asset/inventory checklist organized within the seven domains of a typical IT infrastructure.

• Perform an asset identification and asset classification exercise for a typical IT infrastructure.

• Explain how a data classification standard is linked to customer privacy data protection and proper security controls.

• Identify where privacy data can reside or traverse throughout the seven domains of a typical IT infrastructure.

• Identify where privacy data protection and proper security controls are needed to assist organizations with maintaining compliance.

Lab #1 Creating an IT Infrastructure Asset List and Identifying Where Privacy Data Resides

2 | LAB #1 Creating an IT Infrastructure Asset List and Identifying Where Privacy Data Resides

Deliverables Upon completion of this lab, you are required to provide the following deliverables to your instructor:

1. Lab Report file; 2. Lab Assessments file.

Instructor Demo The Instructor will present the instructions for this lab. This will start with a general discussion of asset identification and asset classification from a risk management perspective. The Instructor will then present an overview of the risks, threats, and vulnerabilities commonly found within the seven domains of a typical IT infrastructure.

Hands-On Steps

Note: This is a paper-based lab. To successfully complete the deliverables for this lab, you will need access to Microsoft® Word or another compatible word processor. For some labs, you may also need access to a graphics line drawing application, such as Visio or PowerPoint. Refer to the Preface of this manual for information on creating the lab deliverable files.

1. On your local computer, create the lab deliverable files.

2. Review the Lab Assessment Worksheet. You will find answers to these questions as you proceed through the lab steps.

3. Review the seven domains of a typical IT infrastructure.

Figure 1 Seven domains of a typical IT infrastructure

An Asset’s Finer Points A domain is not the same as an asset. And a piece of hardware does not always equate to one asset. Many assets can be in one domain, such as the System/Application Domain. A single hardware firewall might present itself as two assets, one in two different domains, for example, a Local Area Network-to-Wide Area Network (LAN- to-WAN) firewall and a Wide Area Network (WAN) firewall. In your own environments, ask yourself, “What function does this perform?”

4 | LAB #1 Creating an IT Infrastructure Asset List and Identifying Where Privacy Data Resides

4. Review Figure 2, which is a Mock IT infrastructure with a Cisco core backbone network.

Figure 2 Mock IT infrastructure with Cisco core backbone network

5. Refer to Figure 2 and note the following information, which describes the details of the Workstation Domain and System/Application Domain at a health care provider under the Health Insurance Portability and Accountability Act (HIPAA) compliance law:

• Workstation Domain: Indicated by the “B” in Figure 2, the Workstation Domain consists of Microsoft® XP 2003, SP2 workstations (50), laptops (50), and desktop computers (50).

• System/Application Domain: Indicated by the “G” in Figure 2, the System/Application Domain consists of the following servers and applications:

o Linux® Server #1 (Domain Name Server [DNS], File Transfer Protocol [FTP], and Trivial File Transfer Protocol [TFTP])

o Linux® Server #2 (Web Server) o Microsoft® Server #1 (e-Commerce Server and Customer Database Subset) o Microsoft® Server #2 (Master Structured Query Language [SQL] Customer

Database and Intellectual Property Assets) o Microsoft® Server #3 (Office Automation, Dynamic Host Configuration

Protocol [DHCP] Server, and Customer Database Subset) o Microsoft® Server #4 (E-mail Server)

6. In your Lab Report file, use the following table to identify three to five IT assets and insert them into the table. Indicate in which of the seven domains of an IT infrastructure the asset resides. Indicate if the asset accesses customer privacy data or contains customer privacy data. Finally, classify the IT asset as Critical, Major, or Minor, where the following defines each:

• Critical: Generates revenues or represents intellectual property asset of organization • Major: Contains customer privacy data • Minor: Required for normal business functions and operations

IT Asset

Description

Seven Domains

of Typical IT

Privacy Data

Impact

Assessment

[Critical-Major-Minor]

Note: Pay attention to the descriptions of the various System/Application assets. Individual assets may fall into different assessment categories. The same certainly holds true for real-world environments you will assess. The guiding question should always be “What does this asset do?” or “What sort of data does it hold?”

7. In your Lab Report file, explain how a data classification standard is related to customer

privacy data protection and security controls.

Note: This completes the lab. Close the Web browser, if you have not already done so.

6 | LAB #1 Creating an IT Infrastructure Asset List and Identifying Where Privacy Data Resides

Evaluation Criteria and Rubrics The following are the evaluation criteria for this lab that students must perform:

1. Create an IT asset/inventory checklist organized within the seven domains of a typical IT infrastructure. – [20%]

2. Perform an asset identification and asset classification exercise for a typical IT infrastructure. – [20%]

3. Explain how a data classification standard is linked to customer privacy data protection and proper security controls. – [20%]

4. Identify where privacy data can reside or traverse throughout the seven domains of a typical IT infrastructure. – [20%]

5. Identify where privacy data protection and proper security controls are needed to assist organizations with maintaining compliance. – [20%]