Day 4 — Afternoon · Domain 5A

Protection of Information Assets — Part A

Domain 5 is the largest and most technically rich domain — where IS audit meets cybersecurity most directly. Part A, Asset Security & Control, covers the frameworks and the protective controls: physical and environmental, identity and access, network and endpoint, encryption and PKI, data loss prevention, and the cloud/mobile/IoT surface.

Session: Afternoon, Day 4 Duration: ~3 hrs Exam Weight: 26% (Domain 5) Knowledge Check: 5 Questions

Overview

The controls that protect information assets

Domain 5 is tied for the heaviest weight at 26%, so it splits naturally across two lessons. Part A is about the controls that protect assets: choosing a framework, hardening the facility, governing identity and access, defending the network and endpoints, encrypting data (and managing the keys), preventing data loss, and securing the cloud/mobile/IoT surface. The lens stays the auditor's — evaluate whether the right controls exist, suit the risk, and actually work. The recurring themes are defense in depth, independent access review, and the key management behind encryption.

Learning Objectives

By the end of this lesson you will be able to…

Key Terms

Vocabulary flashcards

👈 Read the term, recall the definition, then click or press Enter to check yourself.

Lesson Content

Study the material

1

Security Frameworks, Standards & Guidelines

Domain 5 protects information assets, and it starts with the frameworks that define what “secure” means. The auditor checks that a framework was deliberately chosen and that its controls are documented, implemented, and monitored.

  • ISO/IEC 27001 (ISMS; Plan-Do-Check-Act; Annex A controls — 93 controls in 4 themes in the 2022 update) and ISO/IEC 27002 (implementation guidance).
  • NIST CSF: under CSF 1.1, five functions — Identify, Protect, Detect, Respond, Recover. CSF 2.0 (2024) adds a sixth function, Govern, and ISACA content is moving to reflect it — know both and note which version a question assumes.
  • NIST SP 800-53 (comprehensive control catalog); CIS Controls (18 controls; Implementation Groups IG1–IG3); COBIT 2019 security objectives (APO13, DSS05).
  • Auditor: a framework formally adopted; appropriate to size, industry, and risk; controls documented, implemented, monitored; a gap analysis exists.
2

Physical & Environmental Controls

Physical and environmental controls protect the facilities that house information assets — and the exam tests them through the lens of defense in depth.

  • Layers: perimeter (fencing, CCTV, guards), building (reception, badge access, visitor logs), data center (mantraps, biometrics, anti-tailgating), racks (locked cabinets).
  • Environmental: temperature/humidity monitoring (ASHRAE), precision cooling, raised flooring, fire suppression (clean agent FM-200/Novec 1230; VESDA early warning), water-leak detection.
  • Power: UPS, PDUs, generators (with fuel management and testing), dual utility feeds.
  • Auditor: access logs reviewed and reconciled; visitor logs and escorts; environmental alerts tested; fire suppression inspected and certified; generator tests documented.
💡 Exam TipPhysical security hinges on defense in depth — multiple independent layers so one failure doesn't expose the asset. A single locked door is not defense in depth; look for at least two independent controls at each security-zone boundary.
Policies, Standards & Security AwarenessPhysical SecurityNetwork & PerimeterHost & EndpointApplicationDATA
Defense in depth layers independent controls around the asset — policy and people on the outside, then physical, network, host, and application controls around the data at the core. No single layer is trusted alone; an attacker must defeat every layer, so one failure never exposes the asset.

Try it — why one strong control is never enough

The diagram above is the idea; here is the math. Toggle layers on and off and watch the chance an attack gets all the way through — because each independent layer only has to be passed, the breach probability is the layers multiplied together. Raise the threat and every layer weakens at once.

Interactive · adjust & explore
Your defenses

Each layer blocks a share of attacks. Stack them.

40% · Moderate
A stronger adversary slips past every layer more easily.
Security layers — click to toggle
The odds
Layers active
Best single layer
Attacks blocked
Breach probability
Toggle layers to see the odds change.
How far an attack gets

Of 100 attacks, the red line is the share still alive after each layer — it drops as layers compound, and each new layer removes less than the last (diminishing returns).

🔎 In practice

The model multiplies the layers as if each were independent — a teaching simplification (a phished credential can defeat several at once). The exam point holds regardless: no single control is trusted alone, and because prevention is never 100%, defense in depth pairs preventive layers with detection and response so a failure is caught, not fatal.

3

Identity & Access Management

IAM ensures the right people have the right access for the right reasons — and access recertification is one of Domain 5's most-tested controls.

  • Identity lifecycle: provisioning (approved need, tied to HR), modification (role changes), recertification (periodic owner review), de-provisioning (prompt revocation on termination).
  • Authentication factors: Type 1 knowledge (password/PIN), Type 2 possession (token, authenticator app), Type 3 inherence (biometrics); MFA combines two or more categories.
  • Authorization models: RBAC (role), ABAC (attributes), DAC (owner-controlled), MAC (system-enforced labels).
  • Privileged access management: least privilege, separate privileged accounts, privileged access workstations, password vaulting and session recording, just-in-time access.
  • SSO & federation: SAML, OAuth 2.0, OpenID Connect; identity providers and service providers.
💡 Exam TipAccess recertification (user access review) is heavily tested. Auditors look for: (1) reviews on a defined schedule, (2) reviews performed by the business manager (not IT), and (3) evidence that inappropriate access was actually revoked — not just rubber-stamped.
4

Network & Endpoint Security

Network and endpoint controls defend the pathways and devices where data lives and moves.

  • Network defense: DMZ, segmentation/microsegmentation (VLANs, prod vs. dev), next-generation firewalls, IDS/IPS.
  • Secure protocols: TLS 1.2+ (1.0/1.1 deprecated), SSH (replace Telnet), SNMPv3, HTTPS/HSTS.
  • Remote access: VPN with MFA, Zero Trust Network Access (identity + device-posture verification), PAM for admin access.
  • Endpoint: EDR, current anti-malware, host firewall, full-disk encryption, Mobile Device Management.
  • Auditor: firewall rules reviewed on a schedule; all endpoints under EDR and current AV; full-disk encryption on portables; deprecated protocols disabled; remote connections logged.
5

Data Encryption & PKI

Encryption protects confidentiality and integrity at rest and in transit — but its value depends entirely on how the keys are managed.

  • Types: symmetric (AES-256), asymmetric (RSA, ECC), hashing (SHA-256/SHA-3).
  • At rest: Transparent Data Encryption, file-system, and media encryption. In transit: TLS 1.2+, SSH, VPN tunnels.
  • Key management: generation, storage, rotation, revocation; Hardware Security Modules; dual control and custodianship.
  • PKI: Certificate Authority (root/intermediate), Registration Authority; X.509 certificates (SSL/TLS DV/OV/EV, code signing, S/MIME).
  • Certificate revocation: a CRL (Certificate Revocation List) is a periodically published list of revoked certificates and may be stale between updates; OCSP (Online Certificate Status Protocol) checks a single certificate's status in real time.
  • Auditor: data encrypted at rest and in transit; current algorithms (AES-256, RSA-2048+, SHA-256+); formalized key management with rotation and revocation; keys stored separately from data; certificate expiration monitored; private keys in HSMs.
SenderEncrypt withRecipient’s PUBLIC keyCiphertextDecrypt withRecipient’s PRIVATE keyRecipient
In asymmetric encryption the keys are a linked pair: anyone can encrypt with the recipient’s public key, but only the matching private key — which never leaves the recipient — can decrypt. The exam’s recurring finding isn’t weak math, it’s weak key management.
💡 Exam TipEncryption is necessary but not sufficient. The most common encryption finding isn't that encryption is missing — it's inadequate key management. Keys stored with the data, never rotated, or with no revocation process undermine the whole control.
6

Data Loss Prevention

Data Loss Prevention detects and blocks unauthorized movement of sensitive data — and it only works when aligned to the classification scheme.

  • Deployment modes: network DLP (traffic leaving), endpoint DLP (USB/print/cloud sync), cloud DLP, storage DLP (repository scanning).
  • Policy: data identification (card numbers, SSNs, health records), detection rules (regex, fingerprinting, ML classification), response actions (block, quarantine, alert, encrypt, log).
  • Auditor: DLP policies aligned to the data classification scheme; coverage complete (network + endpoint + cloud); alerts reviewed and investigated; exceptions documented and approved.
7

Cloud, Virtualization, Mobile, Wireless & IoT

Modern environments extend far beyond the data center. Each new surface — cloud, virtualization, mobile, wireless, IoT — adds controls the auditor must evaluate.

  • Cloud: the shared-responsibility model — the customer always owns the data, and responsibility shifts up the stack from IaaS to SaaS; CASB, cloud-native security, identity federation with MFA, IaC configuration scanning.
  • Virtualization: hypervisor hardening, VM isolation (prevent VM escape), virtual micro-segmentation.
  • Mobile: MDM/EMM (PIN, encryption, remote wipe), BYOD/COPE/CYOD policies, app containerization (MAM).
  • Wireless: WPA3 is current; WPA2 carries the KRACK key-reinstallation weakness, so keep firmware patched. Audit procedures include wireless site surveys, rogue-AP detection, WPA2-Enterprise with RADIUS, and guest-network isolation.
  • IoT: change default credentials, manage firmware updates, segment onto a separate VLAN; inventory and discovery are hard.
  • Auditor: shared responsibility documented; cloud configs scanned (CIS benchmarks); MFA for cloud consoles; mobile under MDM; wireless on WPA2-Enterprise/WPA3; IoT inventoried and segmented.

Scored Knowledge Check

Test your Domain 5A judgment

Select the best answer for each question, then submit for your score and the rationale. Watch defense in depth, independent access review, and key management.

Q1.Access recertifications are performed annually by the IT security team, who review system-generated access reports. The MOST significant deficiency is:

Question 1 options
Correct: B. Access reviews must be performed by business managers who know each user's job function — not by IT security, who cannot determine whether access is appropriate for a business role. IT may facilitate and monitor, but the business makes the appropriateness determination. Why the others fall short: A review frequency isn’t the core deficiency; C an external auditor doesn’t own operational access reviews; D the reports are fine — the wrong reviewer is the issue.

Q2.Encryption uses AES-256 at rest and TLS 1.2 in transit, but encryption keys are stored on the same database server as the encrypted data. The MOST significant finding is:

Question 2 options
Correct: C. Storing keys on the same server as the data eliminates the benefit of encryption — compromise the server and the attacker gets both data and keys. Keys must be stored separately, ideally in an HSM. Why the others fall short: A TLS 1.2 is acceptable, not the finding; B AES-256 is current and strong — downgrading is wrong; D blanket end-to-end encryption distracts from the key-storage flaw.

Q3.IoT environmental sensors are deployed on the same network segment as the production control systems. The auditor should identify this as:

Question 3 options
Correct: B. IoT devices are hard to secure (limited updates, weak authentication) and should be segmented from operational technology and production control systems. Co-mingling them creates significant risk of lateral movement. Why the others fall short: A being ‘IT-managed’ doesn’t remove the segmentation risk; C it isn’t a physical-installation issue; D inventory is secondary to the isolation gap.

Q4.An IS auditor finds that remote administrative access to production servers uses only a username and password, with no second factor. The MOST appropriate recommendation is:

Question 4 options
Correct: B. MFA is the expected control for privileged and remote access; it defends against credential theft and reuse in a way that password complexity alone (A) cannot. Why the others fall short: A stronger passwords still leave a single factor; C time-of-day limits don’t fix single-factor access; D renaming accounts is security-by-obscurity.

Q5.A data center's only access control is a single badge-reader door to the server room. The IS auditor should identify this as:

Question 5 options
Correct: B. Physical security relies on defense in depth: multiple independent layers so the failure of one does not expose the asset. A single door is one layer, not a layered control. Why the others fall short: A logging a single door doesn’t create layers; C the gap exists whether or not entries are logged; D capacity isn’t the concern — layered control is.