ISC2 CISSP (Certified Information Systems Security Professional)Security OperationsMedium
An organization is deploying a new cloud-based customer relationship management (CRM) system. To ensure data privacy and compliance, they are implementing a strategy to encrypt all sensitive customer data both when it is stored and when it is being transmitted between the user's browser and the cloud service. Which of the following foundational security operations concepts does this strategy primarily address?
- AResource Protection
- BVulnerability Management
- CSecurity Governance
- DData Loss Prevention (DLP)
Show answer & explanationAnswer & explanation
Correct answer: A. Resource Protection
Resource protection involves implementing controls to safeguard an organization's assets, including data, against unauthorized access, use, disclosure, disruption, modification, or destruction. Encrypting data at rest and in transit is a direct technical control for protecting the sensitive data resource.
Why the other options are wrong
- B. Vulnerability management identifies and remediates weaknesses, whereas encryption is a protective measure against compromised resources.
- C. Security Governance establishes the framework and oversight, but encryption is a technical implementation, not governance itself.
- D. DLP focuses on preventing sensitive data from leaving the organization, but encryption is a broader concept for protecting data in various states (at rest, in transit) regardless of exfiltration attempts.
Resource Protection
Resource protection refers to the implementation of controls and measures to safeguard an organization's assets, including data, systems, and facilities, from unauthorized access, use, disclosure, disruption, modification, or destruction.
- Aims to preserve confidentiality, integrity, and availability (CIA).
- Involves technical, administrative, and physical controls.
- Examples include encryption, access controls, backups, and physical security.
Memory trick: Protect the resources, govern the process, manage the risks.