Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber security Introductory RG flashcards > .02 RG Vocab Information Security & Risk Management > Flashcards

.02 RG Vocab Information Security & Risk Management Flashcards

1
Q

Confidentiality

A

preserves authorized restrictions on information access and disclosure,
including means for protecting personal privacy and proprietary information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Integrity

A

guards against improper information modification or destruction, ensuring
information nonrepudiation and authenticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Availability

A

ensures timely and reliable access to and use of information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

NIST Identify

A

Asset management, business environment, governance, risk assessment,
risk management strategy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

NIST Protect

A

Access control, awareness training, data security, information protection
processes and procedures, maintenance, protective technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

NIST Detect

A

Anomalies and events, security continuous monitoring, detection processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NIST Respond

A

Response planning, communications, analysis, mitigation, improvements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NIST Recover

A

Recovery planning, improvements, communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RML Categorize

A

Classify the system and information processed, stored, and transmitted based
on impact analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

RML Focus 1

A

Inform organizational risk management processes and tasks by determining the
adverse impact on organizational operations and assets, individuals, other organizations, and
the nation concerning the loss of confidentiality, integrity, and availability of organizational
systems and the information processed, stored, and transmitted by those systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

RML Select

A

Choose an initial set of controls for the system and tailor the controls as needed to
reduce risk to an acceptable level based on an assessment of risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

RML Focus 2

A

Select, tailor, and document the controls necessary to protect the information system
and organization commensurate with the risk to organizational operations and assets,
individuals, other organizations, and the nation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

RML Implement

A

: Identify and activate the necessary controls and describe how they are
employed within the system and its operating environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

RML Focus 3

A

Initiate the controls in the security and privacy plans for the system and the
organization and document the specific details of the control implementation in a baseline
configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

RML Assess

A

: Evaluate the controls to determine if they are implemented correctly, operating as
intended, and producing the desired outcomes concerning satisfying the security and privacy
requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

RML Focus 4

A

Determine if the controls selected for implementation are implemented correctly,
operating as intended, and producing the desired outcome concerning meeting the security
and privacy requirements for the system and the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RML Authorize

A

Certify and enable the system or common controls based on determining that
the risk to organizational operations and assets, individuals, other organizations, and the
nation is acceptable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RML Focus 5

A

Provide organizational accountability by requiring a senior management official to
determine if the security and privacy risk (including risk to the supply chain) to organizational
operations and assets, individuals, other organizations, or the nation based on the operation
of a system or the use of common controls is acceptable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Monitor

A

Observe the system and the associated controls on an ongoing basis, including
assessing control effectiveness, documenting changes to the system and environment of
operation, conducting risk assessments and impact analyses, and reporting the security and
privacy posture of the system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

RML Focus 6

A

Maintain an ongoing situational awareness about the security and privacy posture of
the information system and the organization in support of risk management decisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Incident

A

is a security event that compromises an information asset’s integrity, confidentiality,
or availability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Breach

A

is an incident that results in the confirmed disclosure—not just potential
exposure—of data to an unauthorized party.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Assets

A

depend on the type of organization; for example, a bank’s asset is its money while the
assets of a software company are in its computer code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Vulnerabilities

A

exist in both software and hardware. The discovery of such vulnerabilities is
only a matter of time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Exploitation

A

is the sse of a vulnerability to gain access to an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Risk

A

is the level of impact on organizational operations (including mission, functions, image,
or reputation), organizational assets, or individuals resulting from the operation of an
information system, given the potential impact of a threat and the likelihood of that threat
occurring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Threat

A

is any circumstance or event that can adversely impact organizational operations
(including mission, functions, image, or reputation), organizational assets, or individuals
through an information system via unauthorized access, destruction, disclosure, modification
of information, and denial of service; also, the potential for a threat source to successfully
exploit a particular information system vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Pen-test

A

also known as penetration testing, is the method of employing hacker tools and
techniques to evaluate security and implemented controls. Another way of understanding a
pen test is to discover both known and unknown vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Confidentiality

A

preserves authorized restrictions on information access and disclosure,
including the means of protecting personal privacy and proprietary information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Integrity

A

guards against improper information modification or destruction, including
ensuring information nonrepudiation and authenticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Availability

A

ensures timely and reliable access to and use of information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Defense-in-Depth

A

is an information security strategy integrating people, technology, and
operations capabilities to establish variable barriers across multiple layers and dimensions of
the organization.

33
Q

Security controls

A

include safeguards, measures, or steps taken to avoid, transfer, mitigate,
reduce, or share the risks to organizational assets.

34
Q

Exposure

A

is the combination of the likelihood and the impact levels of risk.

35
Q

Red Team

A

is a group of people authorized and organized to emulate a potential adversary’s
attack or exploitation capabilities against an enterprise’s security posture. The Red Team’s
objective is to improve enterprise cybersecurity by demonstrating the impacts of successful
attacks and what works for the defenders (i.e., the Blue Team) in an operational environment.
Also known as the Cyber Red Team.

36
Q

Blue Team

A

is a group responsible for defending an enterprise’s use of information systems
by maintaining its security posture against a group of mock attackers (i.e., the Red Team).
Typically the Blue Team and its supporters must defend against real or simulated attacks 1)
over a significant period; 2) in a representative operational context (e.g., as part of an
operational exercise); and 3) according to rules established and monitored with the help of a
neutral group refereeing the simulation or exercise (i.e., the White Team).

37
Q

Pentest

A

is a method of testing where testers target individual binary components or the
application as a whole to determine whether intra- or intercomponent vulnerabilities can be
exploited to compromise the application, its data, or its environmental resources.

38
Q

Malware

A

is hardware, firmware, or software intentionally included or inserted into a system
for a harmful purpose.

39
Q

Rogue access point

A

is an unauthorized access point connected to a network.

40
Q

Ransomware

A

disables the victim’s access to data until a ransom is paid. (e.g., Ryuk)

41
Q

Fileless malware

A

changes files native to the OS (e.g., Astaroth).

42
Q

Spyware

A

collects user activity data without the user’s knowledge (e.g., DarkHotel)

43
Q

Adware

A

serves unwanted advertisements (e.g., Fireball types of malware and their
characteristics).

44
Q

Trojans

A

disguise themselves as desirable code (e.g., Emotet).

45
Q

Worms

A

spread through a network by replicating themselves (e.g., Stuxnet).

46
Q

Rootkits

A

give hackers remote control of a victim’s device (e.g., Zacinlo).

47
Q

Keyloggers

A

monitor a user’s keystrokes (e.g., Olympic Vision).

48
Q

Bots

A

launch a broad flood of attacks (e.g., Echobot).

49
Q

Mobile malware

A

infects mobile devices (e.g., Triada)

50
Q

Malware

A

is a broad term used to describe malicious software, including spyware,
ransomware, viruses, and worms. Malware breaches a network through a vulnerability,
typically when a user clicks a dangerous link or email attachment that installs risky software.
Once inside the system, malware can do the following:
● Block access to key components of the network (ransomware).
● Install malware or additional harmful software.
● Covertly obtain information by transmitting data from the hard drive (spyware).
● Disrupt certain components and render the system inoperable.

51
Q

Phishing

A

involves sending fraudulent communications that appear to come from a
reputable source, usually through email. The goal is to steal sensitive data like credit card and
login information or install malware on the victim’s machine. Phishing is an increasingly
common cyberthreat.

52
Q

On-Path attacks

A

are also known as eavesdropping attacks, which occur when attackers
insert themselves into a two-party transaction. Once the attackers interrupt the traffic, they
can filter and steal data.
The following are two common points of entry for On-Path attacks:
1. Attackers can insert themselves between a visitor’s device and the network on
unsecured public Wi-Fi. Without knowing, the visitor passes all information through
the attacker.
2. Once the malware has breached a device, an attacker can install software to process
all of the victim’s information.

53
Q

Denial of Service attacks

A

lood systems, servers, or networks with traffic to exhaust
resources and bandwidth. As a result, the system is unable to fulfill legitimate requests.
Attackers can also use multiple compromised devices to launch this type of attack. It may
also be known as a Distributed Denial of Service (DDoS) attack.

54
Q

SQL injection

A

is a Structured Query Language (SQL) injection that occurs when an attacker
inserts malicious code into a server that uses SQL and forces the server to reveal information
it normally would not. An attacker may carry out a SQL injection by simply submitting
malicious code into a vulnerable website search box. Learn how to defend against SQL
injection attacks.

55
Q

Zero-day exploits

A

hit after a network vulnerability is announced but before a patch or solution is implemented. Attackers target the disclosed vulnerability during this window of time. Zero-day vulnerability threat detection requires constant awareness.

56
Q

DNS tunneling

A

utilizes the Domain Name System (DNS) protocol to communicate non-DNS
traffic over port 53. DNS tunneling sends HTTP and other protocol traffic over DNS. There are
various legitimate reasons to utilize DNS tunneling. However, there are also malicious
motivations for using DNS tunneling virtual private network (VPN) services. This tactic is used
to disguise outbound traffic like DNS, concealing data typically shared through an internet
connection. DNS requests are manipulated to exfiltrate data from a compromised system to
the attacker’s infrastructure for malicious use. It can also be used for command and control
callbacks from the attacker’s infrastructure to a compromised system.

57
Q

RT Accept

A

Risk is accepted, and no measures are implemented to reduce its probability or
impact.

58
Q

RT Avoid

A

Choose operations that do not lend themselves to a particular risk (e.g., relocating a
factory from a region prone to a particular natural disaster to one that is not prone to that
disaster).

59
Q

RT Mitigate

A

Implement controls to reduce the probability and impact of the threat/risk
materializing.

60
Q

RT Share

A

Engage others in the operations, so multiple parties assume the risk.

61
Q

RT Transfer

A

Through the purchase of insurance, an organization can transfer risk to another
party.

62
Q

Payment Card Industry - Data Security Standard (PCI-DSS)

A

The Payment Card Industry
(PCI) has a Data Security Standard (DSS) with penalties for noncompliance by vendors. It is
one of the most popular industry standards. If a company utilizes any payment card for any
operation, it is a must for the selected service provider to be PCI-DSS compliant.

63
Q

The Health Insurance Portability and Accountability Act (HIPAA)

A

This congressional
act specifies and requires data privacy and protection for medical information

64
Q

California Consumer Privacy Act (CCPA)

A

This act extends privacy protections to the
internet. Under CCPA, consumers may request and access the personally identifiable
information (PII) data stored by companies. Businesses are required to provide a notice to
consumers before their data can be sold.

65
Q

General Data Protection Regulation (GDPR)

A

This regulation was adopted during March
2014 to replace European Union (EU) privacy directive 95/46/EC (EU, n.d.). GDPR is one of the
toughest privacy and security laws passed by the EU. Its reach extends to any organization
collecting and using data related to people within its member countries. Violators of the
GDPR face harsh fines.

66
Q

IRL Computer security incident

A

is a violation or imminent threat of violation of computer
security policies, acceptable use policies, or standard security practices.

67
Q

IRL An event

A

is any observable occurrence in a system or network. Events include a user
connecting to a file share, a server receiving a request for a webpage, a user sending email,
or a firewall blocking a connection attempt. Adverse events have negative consequences,
such as system crashes, packet floods, unauthorized use of system privileges, unauthorized
access to sensitive data, and execution of malware that destroys data.

68
Q

IRL Central incident response team

A

handles incidents throughout the organization

69
Q

IRL Distributed incident response team

A

may be one of several teams within an organization
with responsibility for a particular logical or physical segment of the organization.

70
Q

IRL Coordinating team

A

is an incident response team that provides advice to other teams
without having authority over those teams.

71
Q

PoIR preparation

A

By establishing its incident response capability, an organization is ready
to respond to incidents and prevent incidents by ensuring that systems, networks, and
applications are sufficiently secure. Although the incident response team is not
typically responsible for incident prevention, it is fundamental to the success of
incident response programs.

72
Q

PoIR Detection and analysis

A

Organizations need to be focused on being prepared to
handle incidents that use common attack vectors. Different types of incidents merit
different response strategies; knowing and preparing for common attack vectors is
very important to success.

73
Q

PoIR Containment and eradication

A

With a focus on minimizing the impact of an
incident, containment and eradication strategies provide time for developing a tailored
remediation plan. An essential part of containment is decision-making (e.g., shutting
down a system, disconnecting it from a network, disabling certain functions).

74
Q

PoIR PostIncident activity

A

: Learning and improving from an incident improves an
organization’s preparedness for the next attack. Documenting lessons learned and
plans for future action and response plan updates are important postincident
activities.

75
Q

Intrusion detection

A

The first tier of an incident response team often assumes
responsibility for intrusion detection. The team generally benefits because it should be
poised to analyze incidents more quickly and accurately, based on its knowledge of
intrusion detection technologies.

76
Q

Advisory distribution

A

A team may issue advisories regarding new vulnerabilities
and threats within the organization. Automated methods should be used whenever
appropriate to disseminate information; for example, the National Vulnerability
Database (NVD) provides information via XML and RSS feeds when new vulnerabilities
are added. Advisories are often necessary when new threats emerge, such as a
high-profile social or political event (e.g., a celebrity wedding) that attackers are likely to
leverage in their social engineering. Only one group within the organization should
distribute computer security advisories to avoid duplicated effort and conflicting
information.

77
Q

Education and awareness

A

Education and awareness are resource multipliers—the
more the users and technical staff know about detecting, reporting, and responding to
incidents, the less drain there should be on the incident response team. This
information can be communicated through many means: workshops, websites,
newsletters, posters, and even stickers on monitors and laptops.

78
Q

Information sharing

A

Incident response teams often participate in information
sharing groups, such as information sharing and analysis centers (ISACs) or regional
partnerships. Accordingly, incident response teams often manage the organization’s
incident information-sharing efforts, such as aggregating information related to
incidents, sharing that information with other organizations, and ensuring that
pertinent information is shared within the enterprise.

79
Q

Research

A

entails anticipating, defeating, and actively countering emerging cyberthreats using
expert insights, innovative approaches/technologies, and investigative practices to protect
the confidentiality, integrity, and availability of information and information systems.

Cyber security Introductory RG flashcards (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions