080082017_NewHorizons Flashcards
3D 2C PR
Directive , Detective ,Deterrent,Corrective , Compensate Preventive, Recovery
Risk response
Reduce or Mitigate
Reject or Ignore
Assign or Transfer
Accept
NIST SP 800-34 used for…
Business Continuity
NIST SP 800-34, 7 categories
Develop Policy
BIA
Identify Preventive Controls
Develop Recovery Strategies
Develop IT Contingency Plan
Plan for Testing
Plan for Maintenance
NIST SP 800-34,
7 categories
<p>Develop Policy BIA Identify Preventive Controls Develop Recovery Strategies Develop IT Contingency Plan Plan for Testing Plan for Maintenance</p>
<p>DR Testing that "tests alternate facility WITHOUT taking main site offline"</p>
<p>Parallel Testing</p>
<p>DR Testing that mimics an actual business disruption by SHUTTING DOWN the original site and testing operations at the alternate site</p>
<p>Full Interruption Testing</p>
<p>DR Testing: Planners and testers walk through the BCP to validate logical workflow of events</p>
<p>Walkthrough Testing</p>
<p>How often to review BCP</p>
<p>Yearly, update when evaluated, update for dept. changes</p>
<p>BCP exercise where staff role play from a conference room</p>
<p>Tabletop</p>
<p>IAAS, PAAS, SAAS examples</p>
<p>IAAS - Compute, Storage
SAAS - Email, Security
PAAS - Compute, OS, DB, All-In-One</p>
Consider doing these 3 things when evaluating a third party for security integration
<p>On-site walkthrough
Document Exchange and Review
Process/Policy Review</p>
ISO 27001
FRAMEWORK: information security management system
CMMI (2002)
Initial -Chaotic, Dependent on individual success
Repeatable - Can repeat process,Project Management,
Defined - Documentation of standards to be consistent
Managed - Quantitative
Optimize - Continuous improvement
CMMI - i stands for
Initial - Chaotic
CMMI - d stands for
Defined - Consistent, documented
CMMI - o stands for
Optimize - Continuous improvement
Which Role classifies data?
Data Owner
Two types of classification levels
Commercial
Military
Military Classification levels
Top Secret -Gave Damage
Secret - Serious Damage
Confidential - Damage
Unclassified - No damage
Commercial Classification levels
Confidential
Private
Public
NIST SP 800-27
Engineering Principles
NIST SP 800-14
Principle and Practices of Security
NIST standards used for design..
800-27 - Engineering
800-14 - Practices of Security
TCB Trusted Computing Base
Hardware
Software
Firmware
CPU Modes (2)
Supervisor/Kernel State: FULL rights
User/Application State: Non-Priv rights.
TCB is mentioned in what publication
Dod Standard 5200.28, Orange Book
Multitasking
Divide Tasks Among Programs
What separates TCB with the rest of the system
Security Perimeter
What is Supervisor/Kernel state
This is part of TCB and allows FULL rights to the OS
Multiprocessing allows programs to be divided amount multiple ________ cpu’s
Physical
Nonvolatile Memory
HD
Primary Storage is
RAM
Secondary Storage is
HD
What is TPM?
Trusted Platform Module TPM
Trust Platform Module TPM has what characteristics?
RSA burned in hw
Stores Cryptographic Keys
User must supply with PW or Physical Token
Lattice
“Higher” and “Lower” levels
Bell Lapadula and Biba
Bell Lapadula
Confidentiality - Practices NEED TO KNOW
Star - No Write Down
Simple - No Read Up
Biba
Integrity - Note: Biba and Clark are for Integrity
Star - No Write Up
Simple - No Read Up
Clark
Integrity - Biba and Clark address Integrity
Uses ACCESS CONTROL SIMPLE
Procedures:
CDI Constrained Data Item, UDI Unconstrained
TP Transformation Procedures
Integrity Verification
Graham-Denning
Create and Delete objects and subjects
Brewer-Nash
Addresses Conflict of Interest
Chinese Wall
Requires:
- Identify Subjects
- One or More data sets
- Conflict Class Definitions for data sets
Discretionary Access Control
Control of their OWN data and can create different access levels
Permission List DACL
Mandatory Access Control
Only access based on OBJECT classification
Labels
Role Based Access Control
Instead of adding users add ROLES to access. Similar to SECURITY GROUPS in Windows
Rule Based Access Control
Sys Admin grants access based on rules.. Example of this is a Firewall
TCSEC created in what year
1983
TCSEC Divisions - Baseline Security, from Rainbow Library
A -= Verified
B - Mandatory
C - Discretionary
D - Minimal
A1- Highest - Verified Protection
B3 - Security Domains
B2 - Structured Protection
B1 - Labeled Security Protection
C2 - Controlled Access
C1 - Discretionary protection
D1 - Did NOT MEET requirements
ITSec
European framework
Common Criteria, 7 areas
ISO - International
EAL1 - Functionality
EAL2 - Structurally
EAL3 - Methodically Tested and Checked
EAL4 - Methodically Designed, Reviewed
EAL5 - Semi-Formally
EAL6
A Reference Monitor in the OS is also called the ______ kernel.
Security
