정답: A
Regarding asset security and appropriate retention, the initial top three areas that are important to focus on are security control baselines, access controls, employee awareness and training. Asset security and appropriate retention are the processes of identifying, classifying, protecting, and disposing of the assets of an organization, such as data, systems, devices, or facilities. Asset security and appropriate retention can help prevent or reduce the loss, theft, damage, or misuse of the assets, as well as comply with the legal and regulatory requirements. The initial top three areas that can help achieve asset security and appropriate retention are:
Security control baselines: These are the minimum set of security controls or measures that are applied to the assets based on their classification, value, and risk level. Security control baselines can help ensure the consistency, effectiveness, and efficiency of the security protection for the assets, as well as facilitate the monitoring and auditing of the security compliance. Security control baselines can include technical, administrative, or physical controls, such as encryption, authentication, policies, procedures, locks, alarms, etc Access controls: These are the mechanisms that regulate who or what can access, use, modify, or delete the assets. Access controls can help prevent or limit the unauthorized or malicious access to the assets, as well as enforce the principle of least privilege and the separation of duties. Access controls can include identification, authentication, authorization, and accountability (IAAA) processes, as well as access control models, such as discretionary, mandatory, or role- based access control Employee awareness and training: These are the activities that educate and inform the employees about the security policies, procedures, and best practices of the organization, as well as the roles and responsibilities of the employees regarding the asset security and appropriate retention. Employee awareness and training can help increase the knowledge, skills, and attitude of the employees towards security, as well as reduce the human errors, negligence, or violations that may compromise the asset security and appropriate retention. Employee awareness and training can include seminars, workshops, newsletters, posters, quizzes, etc.
