100 Series Study List 106-110 Flashcards
106- Identify the directives that govern personnel security.
BASIC POLICY: This regulation establishes the Department of the Navy (DON) Personnel Security Program (PSP) under the authority of Executive Order (EO) 12968.
106- Define top-secret classification to include the color code.
Orange Classification - level applied to information whose unauthorized disclosure could reasonably be expected to cause exceptionally grave damage to the national security.
106- Define secret classification to include the color code.
Red Classification - level applied to information whose unauthorized disclosure could reasonably be expected to cause serious damage to the national security.
106- Define confidential classification to include the color code.
Blue Classification - level applied to information whose unauthorized disclosure could reasonably be expected to cause damage to the national security.
106- Define unclassified classification to include the color code.
Green Classification - level applied to information whose unauthorized disclosure would reasonably be expected to cause no damage to the national security.
106- Explain what is meant by “need to know.”
Describes the restriction of data, which is considered very sensitive.
106- Top Secret: State the type of investigation and how often it is updated for access to the following classification levels:
The investigative basis for Top Secret clearance eligibility is a favorably completed SSBI, SSBI-PR or PPR. Must be updated every 5 years by a PR.
106- Secret/Confidential: State the type of investigation and how often it is updated for access to the following classification levels:
The investigative basis for Secret or Confidential clearance eligibility is a favorably completed NACLC or ANACI. Is updated every 10 and 15-years, respectively.
106- Sensitive Compartmented Information (SCI): State the type of investigation and how often it is updated for access to the following classification levels:
The investigative requirement for access to SCI is a favorably adjudicated SSBI. An SSBI-PR is required to be submitted every 5 years.
106- What is a SAER is and its purpose
Security Access Eligibility Report
106- What event should be reported to the SSO
Financial issues. - Legal issues. - U/A. - Mental Illness. - Marriage to a foreign national. - Anything that could question your character, integrity, physical and Mental health needs to be reported. - Sexual Misconduct-Criminal Conduct - Misuse of information technology systems.
106- Who has overall authority of, and controls access to, a SCIF.
The Special Security Officer (SSO)
106- Identify the use of the SF-700
(Security Container Information): Form that contains vital information about the security container in which it is located.
106- Identify the use of the SF-701
(Activity Security Checklist): Checklist that is filled out at the end of each day to ensure that classified materials are secured properly and allows for employee accountability in the event that irregularities are discovered.
106- Identify the use of the SF-702
(Security Container Check Sheet): Provides a record of the names and times that persons have opened, closed and checked a particular container (safe) that holds classified information.
106- Identify the use of the SF-703
Top Secret Cover Sheet - Cover sheets are placed on top of documents to clearly identify the classification level of the document and protect classified information from inadvertent disclosure.
106- Identify the use of the SF-153
(COMSEC Material Report) - Used to document the: Transfer; Inventory; Destruction; Hand Receipt; or Other conditions of Communications Security (COMSEC) material.
106- Identify the use of the SF-312
(Classified Information Nondisclosure Agreement) - contractual agreement between the U.S. Government and a cleared employee that must be executed as a condition of access to classified information.
106- State when safe combinations should be changed.
Safe combinations should be changed: At least once every two years. Sooner, if the combination has been compromised. Sooner, if an individual who holds the combination transfers from the command or otherwise no longer requires it.
106- What is an FDO and state their responsibilities.
FOREIGN DISCLOSURE OFFICE (FDO) Military information is a national security asset which must be conserved and protected and may be shared with foreign representatives only when there is a clearly defined advantage to the United States
106- State the responsibilities of the TSCO
Top Secret Control Officer (TSCO): Reports directly to the Security Manager: - Must be an officer, senior non-commissioned officer E-7 or above, or a civilian employee, GS-7 or above. - Must be a U.S. citizen and have been the subject of a favorably adjudicated SSBI within the previous five years. Maintain a system of accountability to record the receipt, reproduction, transfer, transmission, downgrading, declassification and destruction of command.
106- State the THREATCON Levels and describe 105- them.
Normal: — No known threat indicated. - Alpha: — General threat of possible terrorist activity against installations and personnel. Bravo: — An increased and more predictable threat of terrorist action. - Charlie: — An incident has occurred or that intelligence has been received indicating that some form of terrorist action is imminent. - Delta: — A terrorist attack has occurred or that intelligence indicates that a terrorist action against a specific location is likely.
106- State the FPCON Levels and describe them.
Normal — applies when a general global threat of possible terrorist activity exists and warrants a routine Security posture. Alpha: — applies when there is an increased general threat of possible terrorist activity against Personnel or facilities, and the nature and extent of the threat are unpredictable. Bravo: — applies when an increased or more predictable threat of terrorist activity exists. Charlie: — applies when an incident occurs or intelligence is received indicating some form of terrorist action or targeting against Personnel or facilities is likely. Delta: — applies in the immediate area where a terrorist attack has occurred or when Intel has been received that terrorist action against a specific Location or person is imminent.
106- Explain what a RAM is.
Random Anti-Terrorism Measure (RAM): Purpose is to identify a set of protective measures in addition to those in effect through the current FPCON.
106- Explain and state the purpose of an EAP.
Emergency Action Plan (EAP)
106- Explain and state the purpose of Emergency Destruction Procedures.; Emergency Destruction Plan (EDP):
Two Types: — Precautionary Destruction: - Hostile action is possible/probable and this is a process to destroy keying material and non-essential manuals in an effort to reduce the amount of material on hand (to prepare for expected Complete destruction). — Complete Destruction: - Hostile action is imminent and all material must be destroyed in priority order. - Three categories of COMSEC material that may require destruction in hostile emergencies: — COMSEC keying material — COMSEC-related material (e.g., maintenance manuals, operating instructions, and general doctrinal publications) — Equipment.
106- State who can give the order to initiate Emergency Destruction.
ONLY THE COMMANDING OFFICER can give the order to commence emergency destruction
106- Explain how, and in what order, material is destroyed during Emergency Destruction.
Emergency Destruction Priorities (in order from top to bottom): — Superseded keying material and secondary variables. — TOP SECRET primary keying material. — SECRET, CONFIDENTIAL, and Unclassified primary keying material. — Future (reserve on board) keying material for use one or two months in the future. — Non-essential classified manuals: — Maintenance manuals. — Operating manuals. — Administrative manuals. Destroy by any legal destruction method for the material.
106- Define SCI.
Sensitive Compartmented Information (SCI): Classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control systems established by the Director of Central Intelligence
106- List the items prohibited in a SCIF and the security risks associated with them.
Personally owned photographic, video, and audio recording equipment. Personally owned computers and associated media. Two-way transmitting equipment. Recording equipment (audio, video, optical). Associated media will be controlled. Test, measurement, and diagnostic equipment.
106- Define a security violation
Compromise of classified information to persons not authorized to receive it or a serious failure to comply with the provisions of security regulations and likely to result in a compromise. — A security violation requires investigation.
106- Define practices dangerous to security (PDS).
Practices which have the potential to jeopardize the security of COMSEC Material if allowed to continue. — There are two types: — Reportable: The action must be reported outside of command. — Non-Reportable: The action must be reported to the Commanding Officer.
106- Explain the security requirements for a SCIF
SCIF (Sensitive Compartmented Information Facility)
106- Explain the security requirements for a TSCIF
T-SCIF (Tactical-SCIF): An accredited area used for actual or simulated war operations for a specified period of time.
106- Explain vault recertification and recurring inspections.
Recurring inspections are required every 24 months.
106- Explain and state the purpose of JPAS.
Joint Personnel Adjudication System (JPAS): — Automated system of record for personnel security management within the DoD, providing a means to record and document personnel security actions.
106- Explain and state the responsibilities of DONCAF.
Department of the Navy Central Adjudication Facility (DONCAF): — A Naval Criminal Investigative Service (NCIS) organization responsible for determining who within the Department of the Navy is: — Eligible to hold a security clearance. — Eligible to have access to Sensitive Compartmented Information (SCI). — Eligible to be assigned to sensitive duties.
106- Discuss how long a Commanding Officer can administratively suspend access before DONCAF revokes a clearance.
“90 days.” The administrative withdrawal or downgrading of access is not authorized when prompted by developed derogatory information. Commands and activities must report all suspensions to the DON CAF no later than 10 working days from the date of the suspension action via JPAS, providing sufficient details to support adjudicative review.
106- State the levels of INFOCON and what each signifies
Information Security Condition (5 levels): — INFOCON 5: — Describes a situation where there is no apparent hostile activity against computer networks. INFOCON 4: — Describes an increased risk of attack. INFOCON 3: — Describes when a risk has been identified. INFOCON 2: — Describes when an attack has taken place but the Computer Network Defense system is not at its highest alertness. INFOCON 1: — Describes when attacks are taking place and the Computer Network Defense system is at maximum alertness.
106- Explain why the U.S. Navy only uses “.mil” email addresses on government systems.
The Navy uses .MIL for its e-mail addresses because the U.S. Department of Defense has exclusive use of this domain.
107- Define IA.
Information Assurance: Information Operations that protect and defend data and IS by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.
107- Define Certification
Certification is a comprehensive evaluation of the technical and non-technical security features of an IT system and other safeguards, made in support of the Accreditation process, to establish the extent that a particular design and implementation meets a set of specified security requirements.
107- Define Accreditation
Accreditation is the formal declaration by the Designated Approving Authority (DAA) that an Information Technology (IT) system is approved to operate in a particular security mode using a prescribed set of safeguards at an acceptable level of risk.
107- Define Designated Approving Authority (DAA)
The official with the authority to formally assume responsibility for operating a system (or network) at an acceptable level of risk.
107- Define ATO
Authorization to Operate. Good for 3 years.
107- Define IATO
Interim Authorization to Operate. Good for up to a maximum of 180 days.
107- Discuss security procedures involved when performing cross-domain transfers
CROSS DOMAIN TRANSFERS Refers to moving files between different classifications of networks, so care must be taken to ensure that classified information is not “spilled” to networks with insufficient classification for the material.
107- What are the five attributes of IA?
Confidentiality; Integrity; Availability; Non-repudiation; Authentication
107- Describe Confidentiality, how it pertains to IA
Authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information
107- Describe Integrity, how it pertains to IA
Information and programs are changed only in a specified and authorized manner
107- Describe Availability, how it pertains to IA
Timely and reliable access to and use of information
107- Describe Non-repudtaion, how it pertains to IA
An authentication that with high assurance can be asserted to be genuine, and that cannot subsequently be refuted.
107- Describe Authentication, how it pertains to IA
a measure of confidence that users or processes that access information are who they say they are and have the appropriate rights to access that information
107- List the 9 categories of computer incidents
Root Level Intrusion (Incident); User Level Intrusion (Incident); Denial of Service (Incident); Malicious Logic (Incident); Unsuccessful Activity Attempt (Event); Non-Compliance Activity (Event); Reconnaissance (Event); Reconnaissance (Event); Explained Anomaly (Event).
107- Define Root Level Intrusion, in reference to computer incidents.
Root Level Intrusion (Incident) - an attacker gained root (administrative) level access to the system, could do anything they wished to the system.
107- Define User Level Intrusion, in reference to computer incidents.
User Level Intrusion (Incident) - an attacker gained user level access to the system. Able to access data as your trusted users could, typically will attempt to escalate privileges to gain root access.
107- Define Denial of Service, in reference to computer incidents.
Denial of Service (Incident) - legitimate users are unable to access your network resources.
107- Define Malicious Logic, in reference to computer incidents.
Malicious Logic (Incident) - virus, worm, Trojan horse has infected a system or systems.
107- Define Unsuccessful Activity Attempt, in reference to computer incidents.
Unsuccessful Activity Attempt (Event) - an attacker tried to gain root or user level access; though stopped this time, you’d want to know someone tried to break in.
107- Define Non-Compliance Activity, in reference to computer incidents.
Non-Compliance Activity (Event) - users or administrators not following procedures or policies, could weaken network defense against other attacks if not corrected.
107- Define Reconnaissance, in reference to computer incidents.
Reconnaissance (Event) probing by hackers to examine the network could be intending to attack soon and gaining what information is available prior to doing so, or even just looking to see who the weaker targets are to decide who they’d want to attack.
107- Define Reconnaissance, in reference to computer incidents.
Investigating (Event) - assigned this category by NCDOC while determining the nature of an incident or event, will be reassigned to the most appropriate category once it is determined.
107- Define Explained Anomaly, in reference to computer incidents.
Explained Anomaly (Event) - systems inside the network which have regular traffic necessary for the network but which sets off IDS alarms as possibly being hostile, used to filter out traffic known not to be hostile.
107- Define IAVA
Information Assurance Vulnerability Alert
