CISSP 16.4 - Apply Resource Protection

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series covers how to protect the media that holds your data, a practical focus of Domain 7. It defines what counts as media and why it matters, then works through protecting media in daily use, caring for backup tapes, safeguarding data on mobile devices, and retiring media securely at the end of its life.

Frequently Asked Questions

What counts as media, and why manage it?

Media is anything that can hold data, and that net is wide: tapes, optical discs, internal and external drives, solid-state drives, flash drives, phone memory cards, and even plain paper printouts. Backups often live on tape, so media management leans heavily on tapes but reaches every format. Handling media well is what preserves the core triad, so marking, handling, and storing it properly prevents leaks, tampering, and destruction all at once.

How do you protect media in daily use?

By locking it down physically and controlling how it connects. Media with sensitive data belongs in a secure spot with tight access control and with temperature and humidity control so it does not corrupt. Many organizations block removable drives outright or log every attempt to use one, because a flash drive is a two-way threat: it can carry malware onto a clean system and smuggle huge amounts of data out. A common middle ground is issuing company-approved, hardened drives with built-in encryption.

How do you care for backup tapes?

By keeping copies apart and shielding them from the environment. The golden rule is at least two copies, one on-site for quick recovery and one in a secure off-site location, so a fire in one place does not erase your only backup. Keep tapes away from magnetic fields, which act like a degausser and wipe them, and away from heat, dust, and moisture. Move them in climate-controlled transport and encrypt them, so a lost tape does not become a disclosed tape.

Do mobile devices count as media?

Yes, they deserve the same respect as any other media, because these devices are storage in your pocket. Laptops, phones, tablets, and smartwatches all pack internal or removable memory that can hold email, attachments, contacts, and documents. The key point for the exam is simple: if a device stores sensitive data, it is media and it needs protecting. Treat a lost phone the way you would treat a lost drive.

How do you retire media at the end of its life?

Carefully, because worn-out media still holds recoverable data. All media has a finite life, often described by a mean time to failure, so watch backups for errors and rotate a tape out the moment it starts failing. Destroy media by how sensitive the data was, often degaussing then bulk shredding. Solid-state drives are special: degaussing does nothing to them and built-in erase can miss data, so many teams simply destroy them physically.

Reference: This article is based on concepts discussed in CISSP 16.4 - Apply Resource Protection.