CISSP: Certified Information Systems Security Professional

Question

While conducting a security review for a new product, an information security professional finds that the organization’s product development team proposes collecting customers’ government-issued identification (ID) numbers for use as unique customer identifiers. Which of the following recommendations should be given to the product development team?

Explanation

Customer identifiers should be independent of government-issued ID numbers, preferably generated randomly, so the application does not expose, reuse, or create a linkable derivative of a sensitive government identifier. NIST guidance recommends randomly generated unique account identifiers and emphasizes minimizing collection and exposure of sensitive personal information.

Learn more

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ107

Community Discussion