Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CC > 1 Security Principles > Flashcards

1 Security Principles Flashcards

1
Q

5 Domains

A

1 Security Principles 2 Business Continuity, Disaster Recovery, and Incident Response (10%) 3 Access Control Concepts 4 Network Security 5 Security Operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

ISC2 Canon 1

A

Protect society, the common good, necessary public trust and confidence, and the infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ISC2 Canon 2

A

Act honorably, honestly, justly, responsibly, and legally

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ISC2 Canon 3

A

Provide diligent and competent service to principals (employer or client)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISC2 Canon 4

A

Advance and protect the profession

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

3 main goals/concerns of information security

A

CIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Confidentiality:

A

ensuring only authorized individuals have access to information and resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Integrity:

A

protecting information from unauthorized changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Availability:

A

ensures authorized access to systems and data whenever needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Confidentiality concerns/attacks (5):

A

1 Snooping, 2 dumpster diving, 3 eavesdropping, 4 wiretapping (electronic eavesdropping) 5 social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Integrity attacks (4)

A

1 unauthorized modification 2 impersonation (social engineering) 3 MITM 4 replay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Availability disruptions (5)

A

1 DoS 2 power outages 3 hardware failure 4 destruction of equipment 5 service outages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Access Control - 3 steps

A

1 Identification (“i’m Dave” , username) 2 authentication (ID, password) 3 Authorization (permissions)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AAAs

A

Authentication, Authorization, Accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An SSO ______

A

shares authenticated sessions across systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Privacy concerns/responsibilities (3)

A

1- we are concerned about our own private information
2 - we have a responsibility to educate users in our own organization
3 - we have a responsibility to assist privacy officials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

2 common forms of private information

A

1 PII 2 PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A legal principle that privacy programs are based on

A

Reasonable Expectation of Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The main responsibility of a cybersecurity professional is to

A

Manage Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Main Risk categories (2)

A

1 Internal
2 External

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Risk shared among different organizations

A

Multiparty Risk (SaaS attack)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk assessment =

A
  • the process of identifying and triaging risks (prioritize) based on the likelihood of occurrence and the expected impact
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Threat =

A
  • external forces that jeopardizes the security of your information and systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Threat vector

A

the method that an attacker uses to get to your target

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Vulnerabilities

A
  • weaknesses in your security controls that a threat might exploit to undermine the CIA of your information or systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Risk =

A

Threat * vulnerability (exists when both a vulnerability and a corresponding threat that might exploit that vulnerability are present)

27
Q

Likelihood =

A

the probability that the event (risk) will actually occur. (low, medium, high)

28
Q

Risk (definition):

A
  • the possibility that the occurrence of an event will adversely affect the achievement of the organization’s objectives
29
Q

Impact =

A
  • the amount of damage that will occur if the risk (event) materializes
30
Q

2 techniques to assess the likelihood and impact of a risk for risk assessment

A

1 Qualitative
2 Quantitative

31
Q

Risk Treatment/Risk Management =

A

The process of analyzing potential responses to risks (on your list) and implementing those responses to control each risk appropriately

32
Q

4 basic Risk Treatment Options

A

1 Risk Avoidance
2 Risk Transference
3 Risk Mitigation
4 Risk Acceptance

33
Q

Risk Profile =

A

the combination of risks that affect an organization

34
Q

Inherent Risk/Raw Risk =

A
  • the level of risk an organization faces before any internal controls are applied
35
Q

Residual Risk/Net Risk =

A
  • the level of risk an organization faces after internal controls have been applied
36
Q

Control Risk =

A

new risks introduced by the implementation of controls

37
Q

Risk Tolerance

A
  • the level of risk an organization is willing to accept (before action is required)
38
Q

The goal of risk management is

A

to make sure that the combination of the residual risk and the control risk is below the organization’s risk tolerance

39
Q

Control objective =

A

the purpose of a security control

40
Q

Defense in Depth =

A
  • applying multiple overlapping controls to achieve the same (control) objective
41
Q

Security Control categories by purpose (3)

A

1 Preventative (stops a security issue from occurring) - firewall
2 Detective - IDS
3 Corrective/Recovery (remediates security issues that have already occurred) - backup tapes

42
Q

Security Control categories by mechanism of action (3)

A

1 Technical/Logical (uses technology to achieve security objectives)
2 Administrative
3 Physical

43
Q

Configuration management purpose =

A

ensures change occurs when desired and in a controlled manner (ensures a stable operating environment)

44
Q

Baseline purpose =

A

a configuration snapshot used to assess whether a system has changed

45
Q

2 critical components of change management

A

Versioning and Version Control
(major version of the software.major update.minor update)

46
Q

Security Governance =

A
  • a framework of policies, practices and strategies (from senior management) with the goal of providing direction and ascertaining that risks are managed appropriately to achieve security goals
47
Q

GDPR =

A

(General Data Protection Regulation)
- applies to all EU residents, regardless of where they are located

48
Q

PCI-DSS

A

Payment Card Industry Data Security Standard

49
Q

Security Policy Framework (4 different types of documents)

A

1 Policies
2 Standards
3 Guidelines
4 Procedures

50
Q

Policies are

A

Rules - mandatory bedrock documents from the top level of the organization. “sensitive information must be encrypted using approved technology” (allows for change)

51
Q

Standards are

A

mandatory (derive their authority from policy) and prescribe the specific details of security controls that the organization must follow (approved encryption algorithms)

52
Q

Guidelines are

A

Advice. Not mandatory - best practices. “employees should use encrypted wireless networks whenever they are available”

53
Q

Procedures are

A

step-by-step instructions to perform a specific task. May be mandatory or optional.

54
Q

AUP =

A

(Acceptable Use Policy) describes authorized uses of technology and what is prohibited

55
Q

Data Handling Policies =

A

defines what is considered sensitive information and how to protect that sensitive information

56
Q

Password Policies =

A

documentation of requirements

57
Q

BYOD (Bring Your Own Device) Policies =

A

the security controls that must be in place
and the types of information that may be accessed

58
Q

Privacy Policies =

A

what PII is retained, and how it will be used (stored, transmitted, etc)

59
Q

Change Management Policies =

A

describe how changes are made to the organization’s technology infrastructure (approval, rollout and rollback)

60
Q

2 ways to protect for service outages:

A

1 Resilient systems (backup hard drives, power supplies, etc) and 2 Redundant systems with failover (back up servers, cloud, etc)

61
Q

AAA in IT (3 steps example)

A

1 username, 2 password (MFA), 3 access control list

62
Q

2 factors used to evaluate (rank/triage) risks:

A

1 likelihood, 2 impact

63
Q

Common Security Policies Content (6)

A

AUP, Data Handling, Password, BYOD, Privacy, Change Management

CC (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions