CISA Information Asset Security: Frameworks, Physical and Environmental Controls, Identity and Access, Network Security and DLP

An information security program is governed by a hierarchy of documents (policy, standards, procedures and guidelines) and is usually built on a recognized framework such as ISO/IEC 27001, which an IS auditor evaluates for completeness, approval, currency and real-world compliance. The hierarchy matters because each level has a different owner, a different level of authority and a different rate of change.

A required numeric value belongs in a standard. Placed in a guideline it becomes optional; placed in the policy it forces senior re-approval every time the value changes, and policies should stay stable and technology-neutral.

Choosing a framework

When an organization needs independent certification to demonstrate assurance to customers, only ISO/IEC 27001 provides it. The others are valuable for structuring or benchmarking a program.

Exceptions

Some systems genuinely cannot meet a standard, typically legacy platforms. Undocumented non-compliance is a governance failure. The right response is a formal exception process: each deviation is recorded, its risk assessed, compensating controls defined, the risk accepted by a manager with authority to accept it, and the exception given an expiry or review date. An exception is a documented risk decision for one system, not a change to the standard: the standard stays in force everywhere else, and the exception lapses unless it is reviewed and renewed.

The data owner, a business manager accountable for a data set, decides its classification and who may access it; custodians and security administrators implement those decisions; and the IS auditor evaluates the arrangement without approving or granting access. Defined ownership of risk, controls and data is itself something the auditor tests.

Two principles follow. First, whoever implements access must not also be the one who decides it: when the same person both authorizes and provisions, no accountable person has approved the access, and a preventive control (authorization by the owner before provisioning) is stronger than any review afterwards. Second, accountability needs one named owner per data set. Data used by many groups still has a single accountable owner, who may consult the others; accountability spread across many people belongs to nobody.

Classification reflects the business harm of disclosure, alteration or loss, which is why the owner sets it rather than the CIO or a custodian. The auditor never approves requests: doing so would make audit part of the control it must later assess.

Aligning classification with governance and external requirements

A classification scheme is sound only if it reflects the organization's data governance and privacy programs and its legal, regulatory and contractual obligations, such as personal data under privacy law, payment card data under PCI DSS or health records under sector rules. Each classification level should carry defined handling rules for storage, transmission, sharing, retention and disposal. The auditor checks that every regulated data type maps to a level whose handling rules meet the obligation, that the privacy function was involved in setting the scheme, and that data is actually labelled and handled as its level requires.

Physical access controls restrict entry to facilities such as data centers to authorized people, and the strongest of them prevent unauthorized entry rather than merely record it. An auditor looks at the controls at each perimeter (site, building, computer room, rack) and at the processes that keep authorization lists current.

Preventive versus detective

• Piggybacking or tailgating (following an authorized person through a door) defeats a badge reader, because the door opens for one authenticated person. A mantrap (two interlocking doors, often with a presence or weight sensor) admits one person per authentication and so prevents it. Turnstiles and guards help too.
• CCTV, badge logs and register reviews are detective: they support investigation after the event.
• Biometric readers strengthen identification at the door but do nothing about people who should no longer be on the list.

Visitors

Signing visitors in, checking identification and issuing visitor badges establishes who is on site. It does not supervise them. In a data center, visitors (including vendors) should be escorted at all times; otherwise they can reach consoles, cabling and equipment unobserved. Recording who is on site and supervising what they do are different control objectives, and only supervision limits what a visitor can reach.

Auditing access lists

The auditor compares the list of active badges with current need: HR records, contractor contract end dates and the people whose roles require entry. Whenever the auditor finds access that should no longer exist, the severity of the finding depends on whether that access was used, so the auditor establishes impact from the access system's own entry records for the period after the need ended. Removing the access is management's remediation, not an audit step.

Data centers use either water-based sprinkler systems or gas-based (clean agent or inert gas) systems to suppress fire, and in every design the protection of human life comes before the protection of equipment.

Water-based systems

Gas-based systems

Clean agents (halocarbon agents such as HFC-227ea, or inert gas blends) extinguish fire without water and leave no residue, so the suppression itself does not damage electronics. They cost more than sprinklers, need a reasonably sealed room to hold the design concentration and are installed with alarms and a pre-discharge delay. New halon is no longer produced under the Montreal Protocol because it depletes the ozone layer; some existing systems still run on recycled halon and are being phased out. Carbon dioxide at extinguishing concentration is lethal, so total-flooding CO2 is generally avoided in occupied rooms and must always have a pre-discharge alarm and time delay that allows evacuation.

Ranking environmental findings

When several environmental weaknesses are found, the auditor ranks them by consequence, and a weakness that could injure or kill people outranks any number that could only damage equipment or interrupt service. For example, a fire exit blocked by stored cartons is more serious than a humidity alarm that reaches nobody at night. A total-flooding gas system that could discharge into an occupied room without warning is a life-safety finding. Supporting life-safety controls include smoke detectors, manual alarms, marked exits, evacuation drills and handheld extinguishers inspected on schedule.

Power protection keeps equipment running through electrical disturbances and outages using surge protection, an uninterruptible power supply (UPS) and a standby generator, while environmental monitoring warns of heat, humidity and water before they cause damage.

The power design is only as good as its weakest tested link, and a backup component that has never run under realistic conditions is unproven. Starting a generator without load shows that it starts, not that it, the transfer switch and its cooling can carry the site, so the auditor looks for periodic load testing at the site's actual load, fuel arrangements for long outages and maintenance records. Who performs these routines matters less than whether they are performed and acted on.

Environmental monitoring

• Temperature and humidity sensors: overheating shortens equipment life; humidity that is too low encourages static, too high encourages condensation.
• Water detectors under the raised floor: raised floors hide cabling and often chilled-water or condensate pipes, so leaks pool unseen; detectors warn staff before water reaches equipment.
• Emergency power-off switch: a safety control to cut power in an emergency, normally covered to prevent accidental activation.
• Alarms should reach a staffed point that responds at any hour.

Identity and access management (IAM) governs the whole lifecycle of a user's access, granting what a new joiner needs, adjusting it when they move and removing it when they leave, so that each person holds only the access their current duties require, with business owners periodically recertifying it. That last requirement is the principle of least privilege: it limits the damage from errors, misuse and compromised accounts.

Role-based access and segregation of duties

Role-based access control (RBAC) grants entitlements through roles that match job functions. Role design must keep incompatible duties apart. For example, a role that can both change employees' bank details and approve the payroll run lets one person redirect salary payments to their own account. The preventive fix is to split those functions into separate roles and block assignment of both to one user. Detective reviews of the conflicting activity are compensating controls, appropriate only where separation is genuinely impractical.

Movers and privilege creep

Privilege creep happens when access is added at each transfer and nothing removes the old access. The root-cause control is a mover process: a transfer recorded in HR triggers removal (or owner re-approval) of the previous role's entitlements. Periodic reviews are detective: they find the excess after it has built up rather than preventing it.

Leavers

A leaver's access should be removed at the point of departure. Any manual or batch hand-off between the HR record and account removal leaves a window. The strongest design feeds termination events from the HR system into the identity management system, so accounts are disabled on the termination date, with detective controls as a backstop for anything the trigger misses.

An HR-driven trigger only covers people HR knows about. Contractors, agency and temporary staff are often engaged through procurement or line managers and never recorded in HR, so they are the group most likely to keep access after leaving. They need a sponsor, an end date on the account and inclusion in the trigger or a separate reconciliation.

Testing leaver controls

To test timeliness, the auditor samples from the complete, authoritative population of leavers (HR termination records, plus contractor end dates) and compares each termination date with the account disable timestamp. The general rule: a population drawn from the control's own output can show only that the cases it processed were handled well; it can never reveal the cases it never saw. Completeness comes from a source independent of the control, and operating effectiveness comes from comparing records, not from descriptions of the process.

Access recertification

Access recertification is the periodic review in which business or data owners confirm that each user still needs their current access, and it is effective only if the reviewer understands what they approve and acts on it.

The reviewer should be the business owner of the application's data, often supported by line managers. They have both the knowledge of job needs and the accountability for the data. Security administrators and service desk staff operate provisioning, so reviewing their own output lacks independence and business context; the IS auditor performing the review would compromise audit independence.

Spotting a rubber stamp

Completion on time proves the control was performed, not that it was effective. Warning signs are patterns showing the reviewer did not engage, such as no access ever removed across several cycles even though staff have moved, or review reports the reviewer could not reasonably interpret. The auditor's next step is to gather evidence of effectiveness, for example by re-performing the review for a sample of users and comparing their entitlements with their current job role, looking for movers and excessive access. Recommendations come after that evidence, not before.

Making reviews meaningful

The most useful improvement is usually comprehension: describe each role or entitlement in business terms (what it lets the user do) and flag sensitive or conflicting access so the reviewer can see what matters. If the reviewer cannot interpret what they see, changing anything else about the review leaves the outcome the same. Reviewers' removal decisions must also be carried out and verified.

Authentication proves a claimed identity using one or more factor types (something you know, have or are), and its strength depends on combining different types, protecting the identity provider in a single sign-on design and holding privileged users individually accountable.

Multifactor authentication

Multifactor authentication (MFA) requires factors from at least two different categories: knowledge (password, PIN, security answers), possession (smart card, hardware token, authenticator app on a registered device) and inherence (fingerprint, face, iris). A smart card plus PIN is two-factor; a password plus PIN, or a password plus security questions, is still one factor; two biometrics are still one factor. Stolen passwords are stopped only by adding a different factor type. Strengthening the same factor makes it harder to guess but no harder to reuse once it has been stolen.

Biometric error rates

The CER is a comparison measure, not necessarily the right operating point. Raising sensitivity lowers FAR and raises FRR. Where unauthorized entry is the overriding concern and retries are acceptable (a vault, a high-security room), the setting should move toward low FAR.

Single sign-on and federation

Single sign-on (SSO) lets users authenticate once to an identity provider that vouches for them to many applications; federation extends that trust across organizations. It improves usability and lets access be removed in one place, but creates a single point of compromise: one stolen identity-provider credential or session opens every connected application. The identity provider therefore needs the strongest authentication (MFA) and close protection. Applications that still accept local usernames and passwords bypass the identity provider, so a leaver disabled centrally, or a user who never enrolled in MFA, can still sign in.

Privileged access

• Shared administrator accounts destroy accountability: the log records the account, not the person. Each administrator needs a named account.
• Where a small team cannot segregate duties, the key compensating control is independent review of privileged activity using logs the administrators cannot alter.
• Emergency (break-glass) accounts must be usable immediately, so control comes from recording each use: the credential is vaulted or sealed and checked out by a named person, every use is logged and reviewed, and the password is changed afterwards.
• Privileged access management tools vault credentials, broker sessions and record activity.

Network security limits who and what can reach each system, using zones separated by firewalls, devices that inspect traffic at the right layer, and controlled remote access paths.

Screened subnets and segmentation

An internet-facing server belongs in a screened subnet (DMZ) between an external firewall that admits only the required public traffic and an internal firewall that tightly restricts what DMZ hosts may reach inside. If the server is compromised, the attacker still faces a second barrier. In a flat network, any compromised workstation can reach sensitive servers directly; the preventive fix is segmentation: placing sensitive systems (such as HR or finance databases) in their own zone with firewall rules that allow only required traffic. Controls that detect attacks or protect data in transit do not change which hosts can reach which, so they do not substitute for segmentation.

Firewall and inspection types

Rule-base review

Most firewalls process rules top to bottom and apply the first match. Specific rules should come first and a final default deny last. A permit rule for any source, destination and service placed above the deny-all matches everything not already handled, so the firewall effectively allows all traffic: the most serious finding in a rule review. Other rule-base weaknesses are rated by how much traffic they could wrongly permit, and periodic rule recertification by the rule owners keeps the base clean.

Remote access

Third-party support access should match the need: enabled for each approved support session, tied to named individuals, logged or monitored, and disabled afterwards. Strengthening authentication on a path that is always open still leaves it open between sessions, and named individuals are needed for accountability. For staff using unmanaged home computers, a full VPN places the device itself on the internal network whatever the authentication strength. Access through a hosted virtual desktop keeps applications and data in the data center and sends only screen and input, so malware on the home device has no direct network path inward. A compromised home device can still capture keystrokes and screen content, so the design reduces rather than removes the risk.

Network access control (NAC) admits a device to the network only after checking its identity and its security posture, and endpoint protection controls what runs on laptops, servers and terminals; an auditor tests both by trying to defeat them and by checking their coverage.

Network access control

802.1X port-based authentication identifies a device (for example by a company-issued certificate) before a switch port or wireless network grants access. On its own it admits a company laptop whatever its state. NAC combines that authentication with a posture assessment (patch level, anti-malware status, configuration) at connection time and can quarantine or remediate a failing device. Identification alone, or reporting on compliance after the device has joined, does not keep an unhealthy device off the network.

The best evidence that NAC works comes from the auditor testing it directly: connecting unregistered and non-compliant test devices at a sample of wired ports and wireless access points across locations and confirming they are refused or quarantined. Configuration shows design, and system-generated records show only the connections the system handled; neither can reveal points where enforcement is missing.

Endpoint controls

Testing coverage

A security console reports only on agents that are installed and communicating, so a fully green dashboard says nothing about endpoints that never received an agent. Coverage is a completeness question: the auditor reconciles the console's agent list with an independent source such as the asset inventory or network discovery. Coverage and effectiveness are separate questions: a control that detects perfectly protects nothing where it is not installed.

Data loss prevention (DLP) identifies sensitive data and monitors or blocks its movement through unauthorized channels, and it works only when the organization has first classified its data, covered the channels that matter and tuned its rules before enforcing them.

Classification comes first

DLP rules describe specific data: payment card numbers, health records, design documents. They can be written only once sensitive data has been identified and classified and its legitimate flows are known. Any deployment step taken before classification produces rules that are either useless or block normal business.

Channel coverage

Choose the component by channel. An action that happens only on the device, such as printing a document or copying it while the device is off the corporate network, can be seen and blocked only by an endpoint agent; a network appliance never sees that transfer.

From monitoring to enforcement

Starting in monitor-only mode is good practice: it shows which rules match legitimate flows without disrupting business. Staying there indefinitely means DLP prevents nothing, and noisy rules hide real incidents among false positives. The organization should use the monitoring data to refine patterns, thresholds and exceptions, then move high-confidence rules to blocking in stages.

Encryption, PKI, cloud, virtualization, mobile and IoT controls are covered in the next lesson in this domain; security awareness, attack methods, security testing, monitoring and incident response are in the Security event management lesson.