ISC2 CISSP (Certified Information Systems Security Professional)Security OperationsMedium

An organization is deploying a new cloud-based customer relationship management (CRM) system. To ensure data privacy and compliance, they are implementing a strategy to encrypt all sensitive customer data both when it is stored and when it is being transmitted between the user's browser and the cloud service. Which of the following foundational security operations concepts does this strategy primarily address?

  1. AResource Protection
  2. BVulnerability Management
  3. CSecurity Governance
  4. DData Loss Prevention (DLP)
Show answer & explanation

Correct answer: A. Resource Protection

Resource protection involves implementing controls to safeguard an organization's assets, including data, against unauthorized access, use, disclosure, disruption, modification, or destruction. Encrypting data at rest and in transit is a direct technical control for protecting the sensitive data resource.

Why the other options are wrong

  • B. Vulnerability management identifies and remediates weaknesses, whereas encryption is a protective measure against compromised resources.
  • C. Security Governance establishes the framework and oversight, but encryption is a technical implementation, not governance itself.
  • D. DLP focuses on preventing sensitive data from leaving the organization, but encryption is a broader concept for protecting data in various states (at rest, in transit) regardless of exfiltration attempts.

Resource Protection

Resource protection refers to the implementation of controls and measures to safeguard an organization's assets, including data, systems, and facilities, from unauthorized access, use, disclosure, disruption, modification, or destruction.

  • Aims to preserve confidentiality, integrity, and availability (CIA).
  • Involves technical, administrative, and physical controls.
  • Examples include encryption, access controls, backups, and physical security.

Memory trick: Protect the resources, govern the process, manage the risks.

More Security Operations questions