2 cissp ® Official Study Guide Eighth Edition

Determining Data Security Controls 
After defi ning data and asset classifi cations, it’s important to defi ne the security requirements 
and identify security controls to implement those security requirements. Imagine that an 
organization has decided on data labels of Confi dential/Proprietary, Private, Sensitive, and 
Public as described previously. Management then decides on a data security policy dictating 
the use of specifi c security controls to protect data in these categories. The policy will likely 
address data stored in fi les, in databases, on servers including email servers, on user systems, 
sent via email, and stored in the cloud. 

---

166
Chapter 5 
■
Protecting Security of Assets
For this example, we’re limiting the type of data to only email. The organization has 
defi ned how it wants to protect email in each of the data categories. They decided that any 
email in the Public category doesn’t need to be encrypted. However, email in all other cat-
egories (Confi dential/Proprietary, Private, Sensitive, and Public) must be encrypted when 
being sent (data in transit) and while stored on an email server (data at rest). 
Encryption converts cleartext data into scrambled ciphertext and makes it more dif-
fi cult to read. Using strong encryption methods such as Advanced Encryption Standard 
with 256-bit cryptography keys (AES 256) makes it almost impossible for unauthorized 
personnel to read the text. 
Table 5.1 shows other security requirements for email that management defi ned in 
their data security policy. Notice that data in the highest level of classifi cation category 
(Confi dential/Proprietary) has the most security requirements defi ned in the security policy. 
TA b l e 5 .1
Securing email data
Classification