Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP - Certified Information Systems Security Professional > 1 - Security Governance > Flashcards

1 - Security Governance Flashcards

1
Q

What is Confidentiality?

A

The concept of the measures used to ensure the protection of the secrecy of data, objects, and resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Object vs Subject

A

Object: passive element in a security relationship such as files, computers, and applications.

Subject: active element in a security relationship such as users, programs, and computers.

A subject acts upon an object.

The management of the relationship between objects and subjects is known as _access control_.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the CIA triad?

A

Confidentiality Integrity Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Integrity?

A

Protecting the reliability and correctness of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability

A

Authorized subjects granted timely and uninterrupted access to objects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the components of AAA services?

A

Identification: subject professes an identity.

Authentication: the process of verifying or testing that the claimed identity is valid.

Authorization: ensures requested activity or access to an object is possible given the rights and privileges assigned to the identity.

Auditing: (or monitoring) programmatic means by which a subject’s actions are tracked and recorded for the purpose of holding the subject accountable for their actions while Authenticated on a system.

Accountability: linking a human to the activities of an online identity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Layering?

A

Also known as Defense in Depth, the use of multiple controls in a series.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is abstraction?

A

Where similar objects are put into groups, classes, or roles that are assigned security controls, restrictions, or permissions as a collective. Also defines what type of data an object can contain, what functions can be performed on them/by them, and what capabilities that object has.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Data Hiding?

A

Preventing data from being discovered or accessed by a subject by positioning the data in a logical storage compartment that is not accessible or seen by the subject.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is encryption?

A

The art and science of hiding the meaning or intent of a communication from unintended recipients.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Security Governance?

A

The collection of practices related to supporting, defining, and directing the security efforts of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the most effective way to tackle security management planning?

A

Via the Top-Down Approach, where upper and senior management is responsible for initiating and defining policies for the organization. Middle management fleshes out security polices into stardards, baselines, guidelines, and procedures. Ops managers and/or security professionals implement the the configurations prescribed in the security management documentation. End users must comply with all security polices of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What position should lead the information security team?

A

Generally the Chief Information Security Officer (CISO), sometimes referred to as Chief Security Officer (CSO), but these 2 roles can be subpositions to each other depending on the organization. Sometimes also refered to as Information Security Officer (ISO).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the key factor of success for every security plan?

A

Approval by security management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the different types of security plans?

A
  • Strategic Plan: A long-term plan that defines organization’s security purpose. Should include a risk assessment.
  • Tactical Plan: A midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan or crafted ad-hoc based on unpredicted events.
  • Operational Plan: A short-term, highly detailed plan based on strategic and tactial plans.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the purpose of Change Management?

A

To ensure that any change does not lead to reduced or compromised security.

  • Implement changes in orderly manner
  • Formalized testing process
  • Changes can be reversed (rolled-back)
  • Users are informed of changes
  • Effects of changes are systematically analyzed
  • negative impacts are minimized
  • Changes are reveiwed and approved by Change Advisory Board (CAB)
17
Q

What is Data Classification?

A

The primary means by which data is protected based on its need for secrecy, sensitivity, or confidentiality. Used to determine how much effort, money, and resources are allocated to protect the data and control access to it.

18
Q

What are the 7 major steps to implement a classification scheme?

A
  1. Identify custodian
  2. Specify evaluation criteria
  3. Classify and label each resource
  4. Document any exceptions
  5. Select the security controls
  6. Specify declassification procudure
  7. Create awareness program for organization
19
Q

What is declassification?

A

When an asset no longer warrants or needs the protection of its currently assigned classification or sensitivity level.

20
Q

What are the commonly used classification themes?

(Levels of classification)

A
  • Government/Military
    • Top Secret: Disclosure will have grave damage to national security.
    • Secret: Disclosure will cause serious damage to national security.
    • Confidential: Disclosure will cause damage to national security.
    • Sensitive but Unclassified: Protects data that could violate the privacy rights of individuals.
    • Unclassified: Does not cause damage.
  • Commercial Business/Private
    • Confidential: Drastic effects on competitive edge of an organization.
    • Private: A significant negative impact could occur for the company or individuals if private data is disclosed.
    • Sensitive: A negative impact could occur for the company if disclosed.
    • Public: Disclosure does not have have a serious impact on the organization.
21
Q

What is a security role?

A

The part an individual plays in the overall scheme of security implementation and administration within an organization.

22
Q

What are the 6 roles seen in a secured environment?

A
  • Senior Manager: The person who is ultimately responsible for the security maintained by an organization.
  • Security Professional: A trained and experienced network, systems, and security engineer who is respnsible for following the directives mandated by senior management.
  • Data Owner: Person responsible for classifying information for placement and protection within the security solution.
  • Data Custodian: The user who is responsible for the tasks of implementing the prescribed protection within teh security solution.
  • User: Any person who has access to secured system.
  • Auditor: Responsible for reviewing and verifying that the security policy is properly implemented.
23
Q

What is a Security Control Framework?

A

The structure of the security solution desired by the organization.

24
Q

What are the 5 key priniciples of COBIT (Control Objectives for Information and Related Technology)?

A
  1. Meeting Stakeholder Needs
  2. Covering the Enterprise End-to-End
  3. Applying a Single, Integrated Framework
  4. Enabling a Holistic Approach
  5. Seperating Governance from Management
25
Q

What is Due Care and Due Dilligence?

A
  • Due Care: Using reasonable care to protect the interests of an organization.
  • Due Dilligence: Practicing the activities that maintain the due care effort.
26
Q

What is a security policy?

A
  • A document that defines the scope of security needed by the organization
  • discusses the assets that require protection
  • which security solutions should provide protection.
27
Q

What are the different focuses of security policies?

A
  • Organizational Security Policy: Issues relevant to every aspect of an organization.
  • Issue-Specific Policy: A specific network service, department, function, or other that is distinct from the organization as a whole.
  • System-Specific Security Policy: Individual systems or types of systems.
28
Q

What are the different security policy categories?

A
  • Regulatory Policy: When industry or legal standards are applicable to your organization.
  • Advisory Policy: Behaviors and activities that are acceptable and defines consequences of violations.
  • Informative Policy: Designed to provide information or knowledge about a specific subject or how an organization interacts with partners and customers.
29
Q

What are Standards, Baselines, and Guidelines?

A
  • Standards: Tactical documents that define steps or methods to accomplish the goals defined by security policies.
  • Baseline: Defines a minimum level of security that every system throughout the organization must meet.
  • Guidelines: Offers recommendations on how standards and baselines are implemented.
30
Q

What is a Security Procedure?

A

aka, Standard Operating Procedure (SOP), a detailed, step-by-step how-to document that describes the exact actions necessary to implement a specific security solution.

31
Q

What is the heiracrhy of security policies?

A
  1. Policies
  2. Standards/Baselines
  3. Guidelines
  4. Procedures
32
Q

What is Threat Modeling?

A

The security process where potential threats are identified, categorized, and analyzed.

33
Q

What are the different approaches for Threat Modeling?

A
  • Proactive Approach: Modeling takes place during the early stages of systems development, specifically during initial design.
  • Reactive Approach: Modeling takes place after a product has been created and deployed.
34
Q

What are the different approaches for identifying threats?

A
  1. Focused on Assets: Uses asset valuation results and attempts to identify threats to the valuable assets.
  2. Focused on Attackers: Identifies potential attackers and teh threats they represent.
  3. Focused on Software: If an organization develops software, it can consider potential threats againts the software.
35
Q

What is the Microsoft STRIDE threat model?

A
  • Spoofing
  • Tampering
  • Repudiation
  • Information Disclosure
  • Denial of Service
  • Elevation of Privilege
36
Q

What is the PASTA (Process for Attack ) threat model?

A
  • Definition of the Objectives (DO) for analysis of risks
  • Definition of Technical Scope (DTS)
  • Application Decomposition and Analysis (ADA)
  • Threat Analysis (TA)
  • Weakness and Vulnerability Analysis (WVA)
  • Attack Modeling & Simulation (AMS)
  • Risk Analysis & Management (RAM)
37
Q

What is Reduction Analysis/Decomposition?

A

Attempt to gain a greater understanding of the logic of the product as well as its interactions with external elements.

Key Concepts:

  • Trust Boundaries: Any location where the level of trust or security changes.
  • Data Flow Paths: The movement of data between locations
  • Privileged Operations: Any activity that requires greater privileges than of a standard user account or process, typically required to make system changes or alter security.
  • Details about Security Stance and Approach: The declaration of the security policy, security foundations, and security assumptions.
38
Q

What is the DREAD rating system?

A
  • Damage Potential
  • Reproducibility
  • Exploitability
  • Affected Users
  • Discoverability
39
Q

What are the different types of assessments for 3rd parties?

A
  • On-Site Assessment: Visit the site of the organization to interview personnel and observe
  • Document Exchange and Review: Investigate the means by which datasets and documentation are exchanged.
  • Process/Policy Review: Request copies of their security policies, processes/procedures, and documentation of incidents and responses for review.
  • Third-Party Audit: Have an independent third-party auditor provide an unbiased review of entity’s security infrastructure.

CISSP - Certified Information Systems Security Professional (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions