Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CASP+ > 1 - Security Influences and Risk > Flashcards

1 - Security Influences and Risk Flashcards

1
Q

Advisory Security Policy

A

Provides instruction on acceptable and unacceptable activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Informative Security Policy

A

Provides information from an education standpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Risk management involves:

A

identification, assessment, analyzation, and mitigation of risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Measurement of information security issues at management levels is accomplished by what?

A

The risk management framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What do risk profiles represent?

A

a cross-section of an organization’s comfort level of which risks it will and will not tolerate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Risk management measure the effect of security on what?

A

business objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Security practitioner must consider what objectives?

A

business and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is NIST?

A

a U.S. government agency that develops a formal series of special publications that detail policies, procedures, and guidelines for the security of federal computer devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The NIST Risk Management Framework (RMF) is detailed in what publication?

A

NISP SP 800-39: Managing Information Security Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The NIST Risk Management Framework (RMF) includes what stages related to security controls?

A
  • Categorize
  • Select
  • Implement
  • Assess
  • Authorize
  • Monitor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is ISO?

A

ISO is the world’s largest standards organization; it creates standard for many industries, including security and technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What organizations are able to provide official accreditation to organization for demonstrating compliance with particular standard and guidelines?

A

NIST and ISO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Many partnership business models involve the exchange of information, making information security requirements what?

A

a cross-business issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

With regard to personnel, business models influence what?

A

how personnel are employed and whether to rely on in-house expertise or offshore talent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the two high-level types of partnerships?

A

formal and informal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Partners share in what?

A

operational responsibility, profits, and liabilities associate with a business

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Policies associate with the user of information by a partner should be?

A

determined in advance and provided to customer(s) for approval

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Customer data cannot be shared with other parties without:

A

notification of business purpose and (in the EU) customer consent, aka opt-in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cloud computing helps organizations in what ways?

A

Reducing costs and improving productivity by utilizing applications, accessibility, storage, availability, and scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Prior to signing an agreement with a cloud provider, organizations must do what?

A

Determine the risk management and assessment processes the cloud provider implements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Reviewing service level agreements allows you to learn what?

A

the service offerings and promises of a cloud, outsourcing, or other provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

As businesses become global what practice with regard to personnel is becoming more common?

A

outsourcing of business functions, including information security activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Merger and acquisitions can result in changes to many business processes, which requires what before completion?

A

Careful attention during due diligence periods, including attention to information security processes

24
Q

What are managed security services?

A

Outsourced security and network services

25
Q

Managed security services can include what?

A
  • physical security
  • vulnerability assessments
  • penetration testing
  • operation security monitoring
  • compliance monitoring/auditing
  • digital forensics
  • other consulting efforts
26
Q

What is the HIPAA Security Rule?

A

It standardizes the protection of PHI and requires administrative, physical, and technical safeguards

27
Q

What is PHI

A

private health information

28
Q

The GLBA’s provisions for financial organizations to protect the privacy of customer data is carried out by what?

A

the Safeguards Rule and the Privacy Rule

29
Q

SOX is an abbreviation for what?

A

the Sarbanes-Oxley Act

30
Q

SOX was created to do what?

A

Mandate publicly trade corporations to implement internal controls, auditing, and disclosure practices to protect businesses, investors, and customers from corporate scandals.

31
Q

FISMA stands for what?

A

Federal Information Security Modernization Act

32
Q

What is the purpose of FISMA?

A

To direct government agencies to enforce various security requirements on government networks and devices

33
Q

PCI DSS stands for what?

A

Payment Card Industry Data Security Standard

34
Q

What does PCI DSS require?

A

All organizations that process payment cards to protect both the transactions and the card holder data

35
Q

EU directives 2002/58/EC & 2009/136/EC both require what?

A

telecoms and ISPs to offer security for their services and to notify customers of security threats

36
Q

GDPR stands for what?

A

General Data Protection Regulation

37
Q

In general, what does GDPR do?

A

Improves the security and privacy practices required when dealing with EU customer data

38
Q

Organizations with international partnerships and locations with need to consider what with regard to export requirements?

A

Both local and foreign export requirements

39
Q

Analysis of competitors will improve organization awareness of what with regard to security?

A

security standards, procedures, guidelines, and best practices

40
Q

An internal audit can be used to do what?

A

Verify compliance with internal and external security requirements, as well as provide management with feedback on risk management efforts

41
Q

The COBIT framework provides what?

A

a set of generally accepted measures, indicators, processes, and best practices to assist in maximizing the benefits of IT

42
Q

COBIT stands for what?

A

Control Objectives for Information Technology

43
Q

HITECH stands for what?

A

Health Information Technology for Economic and Clinical Health

44
Q

The HITECH Act generally does what?

A

widens the scope of privacy and security protections available under HIPAA

45
Q

Client and customer data requirements result in what?

A

Organizational security requirements

46
Q

Top-level management evaluates security using what mindset?

A

a risk management mindset

47
Q

Deperimeterization describes what?

A

The moving of organization boundaries from the edge of the network to wherever the user’s device is.

(This includes the edge network, cloud environment, Wi-Fi network, the user’s home network, or networks accessed while traveling)

48
Q

How are teleworkers distinguished from telecommuters?

A

telecommuters work from home, whereas teleworkers travel to non-main office locations like branches or customer sites

49
Q

What does COPE stand for with regard to mobile devices?

A

Corporate Owned/Personally Enabled

50
Q

COPE describes what situation?

A

corporations buy devices but employees use them for personal and business needs

51
Q

CYOD stands for what?

A

Choose your own device

52
Q

A CYOD policy allows a business to do what?

A

Publish a limited list of devices that employees can buy, allowing the business to limit the disparity of devices to support while giving employees some level of choice

53
Q

Enterprise standard operating environments provide what benefits to the organization?

A

reduce complexity, improve security, and reduce resource requirements for operations

54
Q

What are the risk management steps, in order?

A
  • Identification
  • Assessment
  • Analyzation
  • Mitigation
55
Q

Security audit findings can be used for what?

A

to facilitate improvements in the security system

56
Q

What is divestiture?

A

When an organization sells off one of its business units

CASP+ (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions