7.5 Resource & Media Protection 

Key Takeaways

CISSP 7.5 focuses on applying resource protection.

The current CISSP outline explicitly includes media management, media protection techniques and protection of data at rest and in transit.

Media includes physical devices and surfaces on which information is stored or recorded.

It can include hard drives, SSDs, tapes, removable drives, optical media, mobile devices and printed material.

Information-bearing storage may also exist inside devices such as printers, scanners, copiers and network equipment.

Do not protect only obvious storage devices.

Media protection should reflect the sensitivity and value of the information it contains.

A useful operational lifecycle is:

Identify → Classify → Protect → Use → Transport → Sanitise.

Sensitive media should be appropriately inventoried and associated with ownership or custody where required.

Media marking can communicate classification and handling requirements.

Access to sensitive media may require physical, logical and cryptographic controls.

Possession of media should not automatically provide access to its information.

Sensitive media should be appropriately protected during storage.

Physical security, environmental controls, access restrictions and encryption can all contribute to media protection.

Physical media transport creates additional risk because the media leaves its normal controlled location.

Transport controls can include authorisation, encryption, suitable packaging, tracking and confirmation of receipt.

Operational tracking of organisational media and forensic chain of custody are related accountability concepts but should not automatically be treated as identical processes.

Removable media creates particular risks because it is portable and can connect to multiple systems.

Risks include malware introduction, data exfiltration, loss, theft, uncontrolled copying and bypass of normal network controls.

Organisations can restrict removable-media use through device controls, approved-media policies, encryption, DLP, malware scanning and logging.

Removable media should be allowed according to need and risk - not simply because a USB port exists.

Media protection techniques can include encryption, access control, physical protection, device control, DLP, integrity protection, write protection, malware scanning, backup and sanitisation.

Protection should follow the information's classification.

Data at rest refers to stored information.

Examples include databases, files, backups, disks and cloud object storage.

Data in transit refers to information being transmitted between systems or services.

Examples include web traffic, API calls, database connections and remote communications.

Data in use describes information actively being processed.

Rest = stored. Transit = moving. Use = processing.

Data at rest can be protected through encryption, access control, physical security, monitoring and appropriate key management.

Full-disk encryption is particularly valuable against offline access to a lost or stolen storage device.

Full-disk encryption does not replace access controls or endpoint security once an authorised system has unlocked the storage.

Cryptographic protection depends on appropriate key management.

A strong encryption algorithm provides little confidentiality if an attacker can easily obtain the required key.

Encrypt the data. Protect the key.

Data in transit can be protected using secure communication mechanisms such as TLS, IPsec, VPN technologies and SSH depending on the use case.

Transport protection can provide confidentiality, integrity and endpoint authentication.

Encryption at rest and encryption in transit protect different data states.

Encrypted disk ≠ encrypted network connection.

Similarly, use of a private or internal network does not automatically mean communications are encrypted.

When evaluating encrypted communications, determine where encryption begins and where it terminates.

TLS may terminate at a reverse proxy or load balancer while subsequent traffic takes a different protected or unprotected path.

Backups require the same security thinking as other copies of sensitive information.

Production encryption does not automatically guarantee that backup exports, snapshots or archives are encrypted.

Another copy of the data = another asset to protect.

Printed information remains media and should be protected according to its sensitivity.

Sensitive documents should not be left unattended at shared printers or disposed of through inappropriate ordinary waste processes.

Devices such as multifunction printers may themselves contain persistent storage.

Embedded storage should therefore be included in equipment retirement and sanitisation processes.

Media sanitisation becomes important before media is reused, reassigned, returned, recycled, sold, donated or otherwise released.

Ordinary file deletion should not automatically be considered secure sanitisation.

Reformatting a device also does not automatically provide appropriate sanitisation assurance.

Looks empty ≠ data unrecoverable.

Data remanence describes residual data remaining after ordinary deletion or attempted removal.

Sanitisation methods should be selected according to information sensitivity, storage technology and the media's intended disposition.

Clear, Purge and Destroy are important sanitisation concepts.

Clear uses suitable logical sanitisation techniques.

Purge provides stronger sanitisation assurance.

Destroy renders the media unusable.

Clear = logical sanitisation. Purge = stronger sanitisation. Destroy = media unusable.

Sanitisation techniques are media-specific.

A technique appropriate for magnetic media may not be appropriate for flash storage, optical media or cloud storage.

Cryptographic erase can render encrypted data inaccessible by appropriately sanitising the cryptographic key material required to recover it.

Its effectiveness depends on suitable encryption and complete management of relevant key material and data copies.

Crypto erase works because the ciphertext becomes inaccessible without the required key.

Modern sanitisation programmes should include appropriate validation of sanitisation effectiveness.

Running a sanitisation process successfully does not by itself provide the strongest possible assurance that the desired outcome was achieved.

Sanitise → Validate → Record.

Media can be sanitised for internal reuse as well as before it leaves the organisation.

A device being passed to another employee may still contain information the new user should not receive.

Cloud computing changes how media protection is implemented because the customer frequently does not control the underlying physical storage.

Cloud data may exist in active resources, snapshots, backups and other provider-managed copies.

Deleting a virtual machine or cloud object does not necessarily mean that every copy immediately disappears.

Provider deletion mechanisms, retention behaviour, encryption, cryptographic keys and contractual requirements therefore become important.

Cloud changes who controls the physical media. It does not eliminate media-protection responsibility.

Third parties may also transport, store, sanitise or destroy media.

Supplier contracts, due diligence, handling requirements and disposition evidence can support appropriate control.

Outsourcing media destruction does not eliminate the organisation's need to govern the risk.

Certificates or records of destruction can provide useful evidence of disposition but should not replace appropriate supplier assurance.

The central CISSP principle is:

identify where sensitive information exists, protect it according to its classification while stored and transmitted, control the media that carries it and ensure residual information cannot remain accessible when that media is reused or leaves organisational control.