A proposal would require hardware security tokens for every anonymous brochure PDF on the parks website. What principle should guide a more appropriate control decision?
Select an answer to reveal the explanation.
Short Explanation
Hardware tokens for a picnic-rules PDF is using a bank vault lock on a free flyer rack. Match the lock to the treasure—save the heavy crypto gadgets for data that actually hurts if it leaks.
Full Explanation
Requiring hardware security tokens for every anonymous brochure PDF on the parks website mismatches control strength to asset sensitivity. Proportionate security matches control cost and friction to data classification and requirement severity: low-risk public brochures that are meant to be widely readable should not be forced behind hardware MFA; reserve high-assurance authenticators for systems handling sensitive resident, financial, or CJI data. Applying the strongest available control to every public artifact regardless of sensitivity wastes budget, harms usability, and can drive shadow workarounds. Reclassifying brochure PDFs as CJI by wordplay to force token MFA falsifies classification and undermines the entire labeling program. Removing brochures entirely so no control decision is needed abandons the public-service purpose instead of selecting appropriate open publication controls (integrity hashing, trusted hosting, routine integrity checks). Exam caveat: risk-based control selection and data classification drive strength; “maximum security everywhere” is rarely the CISSP answer for public low-sensitivity content. Operational check: confirm brochure classification as public, publish without hardware-token gates, apply basic web integrity and availability controls, and reserve hardware tokens for privileged admin and sensitive app access with documented rationale.